CVE-2026-56356: n8n Chat Trigger Stored XSS via Unsanitized Custom CSS

Technical summary

The Chat Trigger node in n8n fails to properly sanitize user input in the Custom CSS field due to misconfiguration of the sanitize-html library. An attacker with workflow authoring privileges can bypass HTML/JavaScript sanitization filters and inject arbitrary script tags or event handlers. When the workflow is saved, the malicious payload persists in the workflow definition. Any user accessing the public chat interface linked to that workflow will have the attacker's JavaScript execute in their browser context, enabling session hijacking, credential theft, or further malware delivery. The vulnerability exists because sanitize-html's configuration does not adequately restrict dangerous CSS properties or script injection vectors in this specific context.

Business impact

Public chat pages powered by vulnerable n8n workflows become vectors for compromising visitor browsers. If those chat pages are customer-facing, marketing-related, or support channels, attackers can harvest session tokens, steal login credentials, redirect users to phishing sites, or inject drive-by malware. For internal n8n deployments used across teams, a malicious workflow author can target colleagues or downstream users. The reputational damage of hosting XSS on a public-facing chat is significant. Additionally, if n8n is used in regulated industries (finance, healthcare, education), this could trigger compliance violations.

Affected systems

n8n versions 1.x before 1.123.27, all 2.x versions from 2.0.0 through 2.13.2, and 2.14.0 are vulnerable. Patched versions are 1.123.27, 2.13.3, and 2.14.1. Any n8n deployment using the Chat Trigger node with public-facing workflows is at risk if it runs an affected version. Self-hosted and cloud-hosted n8n instances are both vulnerable.

Exploitability

Exploitation requires authentication and workflow modification permissions—a meaningful hurdle that rules out completely unauthenticated attacks. However, within organizations where developers, citizen developers, or workflow designers have broad access, an insider or compromised account can easily execute this attack. No user interaction is required from the victims; visiting the chat page triggers the XSS automatically. The attack is reliable and does not depend on social engineering or victim clicks. CVSS reflects this: low privileges required, low attack complexity, but user interaction needed at the victim end (rated as the UI requirement).

Remediation

Upgrade to n8n 1.123.27 (for 1.x users), 2.13.3 (for 2.0–2.13.x users), or 2.14.1 (for 2.14.0 users). After patching, audit existing Chat Trigger workflows for any suspicious CSS or HTML content that may have been injected. Review workflow access controls to ensure only trusted users can create or edit Chat Trigger workflows. Consider disabling the Custom CSS field entirely if your use case does not require it, or enforce a content security policy (CSP) at the application level to further mitigate XSS.

Patch guidance

Verify the patched versions match your deployment: for legacy 1.x, confirm you are at 1.123.27 or later; for 2.x branches, confirm you are at 2.13.3 or later (if you were on 2.0–2.13.2) or 2.14.1 or later (if you were on 2.14.0). Test the patch in a staging environment before production rollout, particularly if your workflows rely on Custom CSS styling—ensure the patched sanitization does not break legitimate formatting. No data migration is required; the fix is in the runtime sanitization logic.

Detection guidance

Search your n8n deployment for Chat Trigger nodes with Custom CSS fields containing suspicious patterns: script tags, event handlers (onclick, onload, onerror), unusual Unicode escapes, or data: URIs. Review workflow audit logs for recent modifications to Chat Trigger custom CSS by unexpected users. Monitor public chat endpoints for unusual JavaScript in the page source or console errors that suggest injected payloads. In a multi-user environment, enable n8n's audit features to flag who edited workflows and when. Web application firewalls or CSP headers in front of n8n can also detect and block inline script execution attempts.

Why prioritize this

Although CVSS is 5.4 (MEDIUM), the stored nature of the XSS and the potential customer impact warrant prompt attention. Public-facing chat is a trust boundary; compromising it damages reputation and user safety. The attack surface is limited to users with workflow creation rights, which reduces organizational risk in most setups, but insider threats and compromised developer accounts are real. Patching is straightforward and carries low risk. Prioritize if Chat Trigger workflows are public-facing; deprioritize slightly if workflows are internal-only and access controls are strong.

Risk score, explained

CVSS 5.4 reflects the requirement for authenticated access and user interaction on the victim's side (visiting the chat page). However, the stored XSS nature means the payload persists and affects all visitors without additional attacker action. The 'Limited Impact' scope (C:L, I:L, A:N) reflects that XSS typically steals session data or causes UI manipulation rather than complete system compromise. Organizations relying on public chat for customer engagement should internally rate this higher than the CVSS suggests; those with restricted internal deployments may rate it lower.

Frequently asked questions