n8n versions prior to 1.123.64, 2.30.1, and 2.29.8 are vulnerable to a stored cross-site scripting attack that could lead to unauthorized user actions.

This is a stored cross-site scripting (XSS) vulnerability (CWE-79) triggered via the cached result URL. An authenticated attacker can inject malicious scripts that execute in the context of other users, including administrators, when they view the affected data.

The CVSS score of 8.4 reflects the high risk of this vulnerability. An XSS attack can be used to hijack user sessions, perform unauthorized actions on behalf of the victim, or redirect users to malicious sites, potentially compromising the integrity of workflows managed within the n8n platform.

Immediate Action: Update n8n to version 1.123.64, 2.30.1, or 2.29.8 depending on your current deployment branch.

Proactive Monitoring: Monitor for suspicious script injections or unusual activity in workflow logs and user access logs.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts within the browser.

Public Exploit Available: No (exploit_available: false)

Administrators must prioritize updating their n8n instances to the specified fixed versions. Given the potential for session hijacking, ensuring that all users are on patched versions is essential to maintaining the security of workflow automations.