CVE-2026-118648 — Vulnerability intelligence
—
Published:
- CVSS
- 8.4
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy. Authenticated members who can create and activate workflows can serve HTML that runs on the n8n origin, letting scripts act with the session of users who open the webhook URL.