Dashboard / CVE-2026-56358

CVE-2026-56358

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 50/100
Published: 2026-06-24 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: Passive
AT: None
VC: Low
VI: Low
VA: None

Description

n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerability in the Form Trigger node's CSS sanitization that allows authenticated users to inject malicious scripts. Attackers with workflow creation permissions can inject XSS payloads that execute persistently for all form visitors, enabling form hijacking and phishing attacks.

Weakness Classification (1)

Affected Software (6)

VendorProductVersion
n8n n8n 0 < 1.123.25
n8n n8n < 1.123.25
n8n n8n 0 < 1.123.25
n8n n8n 2.0.0-rc.0 < 2.11.2
n8n n8n 2.0.0-rc.0 < 2.11.2
n8n n8n 0 < 1.123.25

References & Advisories (2)

Bug Bounty Relevance

50 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

5.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

EPSS — Exploitation Probability

0.24%
Raw Score 0.002430
Percentile 15.5%
Date 2026-10-29

Intelligence Sources

mitre ref →
nvd ref →

External Links