Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| n8n-io | n8n | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 14 Oct 2026 23:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently sanitised customCss values are interpolated into the page as markup. Workflow authors can publish a chat without n8n user authentication whose payload executes on the instance origin, acting on the sessions of signed-in visitors. | |
| Title | n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter | |
| First Time appeared |
N8n
N8n n8n |
|
| Weaknesses | CWE-79 | |
| CPEs | cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:* | |
| Vendors & Products |
N8n
N8n n8n |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-14T22:52:22.958Z
Reserved: 2026-10-14T22:12:22.055Z
Link: CVE-2026-110847
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-10-14T23:17:25.407
Modified: 2026-10-14T23:17:25.517
Link: CVE-2026-110847
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')