CVE-2026-56358: n8n Form Trigger Stored XSS Vulnerability (CVSS 5.4)

Technical summary

The vulnerability stems from insufficient CSS sanitization in the Form Trigger node component. When users design forms via the n8n UI, malicious actors with workflow creation permissions can craft XSS payloads that bypass the sanitization filter. Unlike reflected XSS, this payload persists in the workflow definition and executes server-side or in every visitor's browser session, making it a stored XSS vulnerability. The CVSS 3.1 score of 5.4 reflects that exploitation requires prior authentication and user interaction (form viewing), but the impact spans form hijacking, credential theft, and phishing at scale.

Business impact

For organizations deploying n8n for form collection, customer intake, or data gathering, a compromised form becomes a vector for credential harvesting and social engineering. An insider or compromised admin account can inject phishing forms that capture user credentials or distribute malware links to all form visitors without triggering typical phishing detection. This is particularly damaging in regulated industries where form data handles PII or financial information. The reputational and compliance costs can exceed the technical remediation effort.

Affected systems

n8n versions 1.x before 1.123.25 and 2.x before 2.11.2 are affected. Version 2.12.0 includes the fix retroactively. Self-hosted n8n deployments and n8n Cloud customers on affected versions require patching. Any form trigger nodes designed before patching should be reviewed for malicious payloads.

Exploitability

Exploitation requires authenticated access with workflow creation permissions, reducing opportunistic exploitation risk. However, the attack requires no complex technical sophistication—a simple HTML/JavaScript payload embedded in form CSS fields executes reliably. User interaction (visiting the form) is required for the XSS to trigger, but forms are typically shared widely. The stored nature means the payload persists indefinitely across all visitor sessions until the form is corrected.

Remediation

Upgrade n8n to version 1.123.25 or later (1.x line) or 2.11.2 or later (2.x line). Version 2.12.0 also contains the fix. After upgrading, audit existing Form Trigger nodes for suspicious CSS or unexpected script content. Consider restricting workflow creation permissions to trusted users and implementing code review processes for form designs that handle sensitive data collection.

Patch guidance

For 1.x users: upgrade to 1.123.25 or later. For 2.x users: upgrade to 2.11.2 or later; 2.12.0 is also a valid target. Self-hosted deployments should prioritize this upgrade given the ease of exploitation by internal users. n8n Cloud customers should verify their current version and apply the update if running affected builds. No downtime should be required for the upgrade itself, but plan a brief maintenance window to validate form functionality post-patch.

Detection guidance

Review Form Trigger node configurations for inline scripts, event handlers (onclick, onerror, etc.), or unusual CSS properties in form definitions. Look for workflow audit logs showing modifications to Form Trigger nodes by unexpected users. Monitor browser console errors on form pages for XSS-related warnings. If using n8n Cloud, request logs showing form node changes in the relevant timeframe. Endpoint Detection and Response (EDR) tools may flag XSS payloads if they contain known malicious domains or patterns.

Why prioritize this

Although the CVSS score is moderate (5.4), the stored XSS nature and form-hijacking potential elevate practical risk. Organizations using n8n for customer-facing forms, lead capture, or authentication flows should prioritize this patch. The low attack complexity and high visibility (every form visitor sees the payload) make this more dangerous than the score alone suggests. Delay increases insider-threat and supply-chain risks.

Risk score, explained

CVSS 5.4 (MEDIUM) reflects the requirement for authenticated access (PR:L) and user interaction (UI:R), plus the limit to confidentiality and integrity (C:L/I:L) without availability impact. However, the stored persistence and cross-user scope (S:C) elevate real-world risk beyond the numeric score. Organizations handling sensitive form data should treat this as a high-priority patch candidate internally.

Frequently asked questions