---
id: CVE-2026-56358
title: n8n - Stored Cross-Site Scripting in Form Trigger Node
summary: >-
  n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included
  in 2.12.0, contains a stored cross-site scripting vulnerability in the Form
  Trigger node's CSS sanitization that allows authenticated users to inject
  malicious…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: n8n
product: n8n
affected:
  - n8n < 1.123.25
  - n8n >= 2.0.0-rc.0 < 2.11.2
  - n8n >= 2.0.0-rc.0 < 2.11.2
  - n8n < 1.123.25
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-24T16:01:36.636711Z'
published: '2026-06-24'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T21:15:47.727Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56358'
references:
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-q4fm-pjq6-m63g'
    label: GitHub Security Advisory (GHSA-q4fm-pjq6-m63g)
  - url: >-
      https://www.vulncheck.com/advisories/n8n-stored-cross-site-scripting-in-form-trigger-node
    label: 'VulnCheck Advisory: n8n - Stored Cross-Site Scripting in Form Trigger Node'
tags:
  - cve.org
epss: 0.00243
epssPercentile: 0.15583
ingestedAt: '2026-11-03T08:39:35.557Z'
---

## Overview

n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerability in the Form Trigger node's CSS sanitization that allows authenticated users to inject malicious scripts. Attackers with workflow creation permissions can inject XSS payloads that execute persistently for all form visitors, enabling form hijacking and phishing attacks.

## Affected

- `n8n < 1.123.25`
- `n8n >= 2.0.0-rc.0 < 2.11.2`
- `n8n >= 2.0.0-rc.0 < 2.11.2`
- `n8n < 1.123.25`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.