CVE-2025-61914

MEDIUM EPSS 12.0%

Published Dec 26, 20256mo ago · Modified Jun 17, 20262w ago

5.4 CVSS 3.1

Medium

Published Dec 26, 2025 6mo ago

Last Modified Jun 17, 2026 2w ago

Description

n8n is an open source workflow automation platform. Prior to version 1.114.0, a stored Cross-Site Scripting (XSS) vulnerability may occur in n8n when using the “Respond to Webhook” node. When this node responds with HTML content containing executable scripts, the payload may execute directly in the top-level window, rather than within the expected sandbox introduced in version 1.103.0. This behavior can enable a malicious actor with workflow creation permissions to execute arbitrary JavaScript in the context of the n8n editor interface. This issue has been patched in version 1.114.0. Workarounds for this issue involve restricting workflow creation and modification privileges to trusted users only, avoiding use of untrusted HTML responses in the “Respond to Webhook” node, and using an external reverse proxy or HTML sanitizer to filter responses that include executable scripts.

CVSS Details

Base Score

5.4

Exploitability

2.3

Impact

2.7

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction Required

Scope Changed

Confidentiality Low

Integrity Low

Availability None

Threat Intelligence

EPSS Exploit Probability

12.0% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

Vendor	Product	Version	Range
n8n	n8n	*	<1.114.0

References 1

github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-58jc-rcg5-95f3

PatchVendor Advisory

Remediation

github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-58jc-rcg5-95f3

PatchVendor Advisory