CVE-2026-56358: medium-severity vulnerability in n8n
n8n - Stored Cross-Site Scripting in Form Trigger Node
Published
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.2%
exploitation probability
0.2%top 86% of all CVEs
observed exploitation
nono source reports it
n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerability in the Form Trigger node's CSS sanitization that allows authenticated users to inject malicious scripts. Attackers with workflow creation permissions can inject XSS payloads that execute persistently for all form visitors, enabling form hijacking and phishing attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
n8n · n8nRelated CVEs — n8n
In the same product, most dangerous first.
CVE-2026-59257MEDIUMn8n - SQL Injection in MySQL v1 executeQuery Operation via Expression InterpolationEPSS 0.6%CVE-2025-71380HIGHn8n - Arbitrary Command Execution via Execute Command NodeEPSS 0.6%CVE-2026-56348MEDIUMn8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters EndpointEPSS 0.5%CVE-2026-56349MEDIUMn8n - Guardrail Node Bypass via Crafted InputEPSS 0.5%CVE-2026-59259MEDIUMn8n - Permission Bypass via Expression Parser Mismatch in External SecretsEPSS 0.4%CVE-2026-58661MEDIUMn8n - Disk Space Exhaustion via Data-Table File Upload EndpointEPSS 0.4%