n8n has XSS in Chat Trigger Node through Custom CSS
Medium5.4CVE-2026-56356 · Published Mar 27, 2026 · updated Jul 8, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| n8n npm | < 1.123.27 | 1.123.27 |
| >= 2.14.0, < 2.14.1 | 2.14.1 | |
| >= 2.0.0-rc.0, < 2.13.3 | 2.13.3 |
Details and references
## Impact An authenticated user with permission to create or modify workflows could inject malicious JavaScript into the Custom CSS field of the Chat Trigger node. Due to a misconfiguration in the `sanitize-html` library, the sanitization could be bypassed, resulting in stored XSS on the public chat page. Any user visiting the chat URL would be affected. ## Patches The issue has been fixed in n8n versions 1.123.27, 2.13.3, and 2.14.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Limit workflow creation and editing permissions to fully trusted users only. - Disable the Chat Trigger node by adding `@n8n/n8n-nodes-langchain.chatTrigger` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2026-56356
More n8n advisories
All n8n| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 26 | n8n Vulnerable to LDAP Filter Injection in LDAP Node CVE-2026-33751Medium4.8fixed in 1.123.27, 2.13.3, 2.14.1 | Medium4.8 | 1.123.27, 2.13.3, 2.14.1 |
| Mar 26 | n8n Vulnerable to XSS via Binary Data Inline HTML Rendering CVE-2026-33749Medium8.9fixed in 1.123.27, 2.13.3, 2.14.1 | Medium8.9 | 1.123.27, 2.13.3, 2.14.1 |
| Mar 26 | n8n has SQL Injection in Data Table Node via orderByColumn Expression CVE-2026-33713High9.9fixed in 1.123.26, 2.13.3, 2.14.1 | High9.9 | 1.123.26, 2.13.3, 2.14.1 |
| Mar 26 | n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE CVE-2026-33696Critical9.9fixed in 1.123.27, 2.13.3, 2.14.1 | Critical9.9 | 1.123.27, 2.13.3, 2.14.1 |
| Mar 27 | n8n has a Stored XSS Vulnerability in its Form Trigger CVE-2026-56358Medium5.4fixed in 1.123.25, 2.11.2 | Medium5.4 | 1.123.25, 2.11.2 |
| Mar 27 | n8n: Authenticated XSS and Open Redirect via Form Node CVE-2026-56354Medium4.1fixed in 1.123.24, 2.10.4, 2.12.0 | Medium4.1 | 1.123.24, 2.10.4, 2.12.0 |