An authenticated stored Cross-site Scripting vulnerability in n8n allows attackers to execute arbitrary scripts in the context of other users, posing a significant security risk.

This is a stored Cross-site Scripting (XSS) vulnerability (CWE-79) triggered via the form completion page. The vulnerability requires the attacker to be an authenticated user to perform the injection, which then executes in the browser of other users who view the affected page.

A successful XSS attack can allow an attacker to hijack user sessions, steal sensitive data, or perform unauthorized actions on behalf of the victim. With a CVSS score of 8.4, this vulnerability presents a high-severity threat to organizational data integrity and user account security.

Immediate Action: Update n8n to version 1.123.69, 2.33.4, or 2.34.1, depending on the current deployment branch.

Proactive Monitoring: Review application logs for suspicious script injections or unusual activity within form configuration settings.

Compensating Controls: Employ a robust Content Security Policy (CSP) to restrict the execution of unauthorized scripts within the browser environment.

Public Exploit Available: Unknown

Administrators must apply the provided security updates immediately to eliminate the XSS vector. Given the high severity and the potential for session hijacking, ensuring all instances of n8n are updated is critical to protecting user credentials and sensitive workflow data.