---
id: CVE-2026-56354
title: n8n - Cross-Site Scripting and Open Redirect in Form Node
summary: >-
  n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches)
  contains cross-site scripting and open redirect vulnerabilities in the Form
  Node due to unsanitized HTML description fields and overly permissive iframe
  sandbox po…
severity: medium
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: n8n
product: n8n
affected:
  - n8n < 1.123.24
  - n8n >= 2.0.0-rc.0 < 2.10.4
  - n8n >= 2.11.0 < 2.12.0
  - n8n >= 2.0.0-rc.0 < 2.10.4
  - n8n < 1.123.24
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-10T16:42:31.372790Z'
published: '2026-07-10'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T21:15:46.293Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56354'
references:
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-w673-8fjw-457c'
    label: GitHub Security Advisory (GHSA-w673-8fjw-457c)
  - url: >-
      https://www.vulncheck.com/advisories/n8n-cross-site-scripting-and-open-redirect-in-form-node
    label: >-
      VulnCheck Advisory: n8n - Cross-Site Scripting and Open Redirect in Form
      Node
tags:
  - cve.org
epss: 0.00238
epssPercentile: 0.14932
ingestedAt: '2026-11-03T08:39:35.556Z'
---

## Overview

n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site scripting and open redirect vulnerabilities in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated users with workflow creation permissions can inject malicious scripts or redirect parameters to perform stored XSS attacks or phishing redirects against end users.

## Affected

- `n8n < 1.123.24`
- `n8n >= 2.0.0-rc.0 < 2.10.4`
- `n8n >= 2.11.0 < 2.12.0`
- `n8n >= 2.0.0-rc.0 < 2.10.4`
- `n8n < 1.123.24`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.