CVE-2025-58177: n8n Workflow Automation XSS Vulnerability

CVE-2025-58177 Overview

CVE-2025-58177 is a stored cross-site scripting (XSS) vulnerability in the n8n open source workflow automation platform. The flaw affects the @n8n/n8n-nodes-langchain.chatTrigger node in versions from 1.24.0 up to but not including 1.107.0. An authorized user can inject malicious JavaScript into the initialMessages field of a LangChain Chat Trigger node and enable public access. When any visitor loads the resulting public chat URL, the payload executes in their browser. The issue is tracked under [CWE-79] and was fixed in version 1.107.0.

Critical Impact
Attackers with workflow edit rights can weaponize public chat URLs to steal session cookies, harvest credentials through phishing overlays, or hijack accounts of unsuspecting visitors.

Affected Products

n8n versions 1.24.0 through 1.106.x
@n8n/n8n-nodes-langchain Chat Trigger node
Self-hosted and cloud n8n deployments exposing public chat URLs

Discovery Timeline

2025-09-15 - CVE-2025-58177 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58177

Vulnerability Analysis

The LangChain Chat Trigger node in n8n renders an initialMessages string in the public chat interface. Prior to version 1.107.0, the node did not sanitize the field before injecting the content into the browser DOM. Any HTML or JavaScript stored in initialMessages executes when a visitor loads the public chat page.

Because the exploit requires an authorized user to configure the node and enable public access, attacks originate from internal or compromised workflow editors. Victims are external users who trust the public chat URL. This creates a stored XSS chain where malicious content persists in workflow configuration and executes across every visitor session.

Root Cause

The root cause is missing input sanitization in the Chat Trigger node templates. The patch introduces a dedicated sanitizeUserInput helper that strips HTML tags, attributes, and dangerous URI schemes such as javascript:, data:, and vbscript: before the initial messages are rendered.

Attack Vector

Exploitation requires an authenticated n8n user with permission to create or edit workflows. The attacker configures a Chat Trigger node, embeds a JavaScript payload in initialMessages, enables public access, and shares the generated public chat URL. Any user who visits the URL executes the payload in their browser context, enabling cookie theft, credential phishing, or redirection to attacker-controlled infrastructure.

typescript

// Patch: sanitization introduced in packages/@n8n/nodes-langchain/nodes/trigger/ChatTrigger/templates.ts
import sanitizeHtml from 'sanitize-html';

function sanitizeUserInput(input: string): string {
	// Sanitize HTML tags and entities
	let sanitized = sanitizeHtml(input, {
		allowedTags: [],
		allowedAttributes: {},
	});
	// Remove dangerous protocols
	sanitized = sanitized.replace(/javascript:/gi, '');
	sanitized = sanitized.replace(/data:/gi, '');
	sanitized = sanitized.replace(/vbscript:/gi, '');
	return sanitized;
}

export function getSanitizedInitialMessages(initialMessages: string): string[] {
	const sanitizedString = sanitizeUserInput(initialMessages);

	return sanitizedString
		.split('\n')
		.map((line) => line.trim())
		.filter((line) => line !== '');
}

Source: GitHub Commit d4ef191

Detection Methods for CVE-2025-58177

Indicators of Compromise

Chat Trigger nodes with initialMessages containing <script>, onerror=, onload=, or protocol handlers like javascript: and data:
Public chat webhook URLs receiving outbound requests to unknown domains after page load
Browser console errors or unexpected network calls originating from public n8n chat pages

Detection Strategies

Audit n8n workflow JSON exports for Chat Trigger nodes and inspect the initialMessages parameter for HTML or JavaScript syntax
Monitor n8n audit logs for creation or modification of Chat Trigger nodes with public: true set
Deploy Content Security Policy (CSP) reporting endpoints to capture inline script execution attempts on public chat URLs

Monitoring Recommendations

Track outbound HTTP requests from browsers loading n8n public chat pages to identify data exfiltration destinations
Alert on n8n instance version strings below 1.107.0 reported in HTTP responses or telemetry
Review privileged user activity for unusual workflow publications, especially from accounts that do not normally expose public triggers

How to Mitigate CVE-2025-58177

Immediate Actions Required

Upgrade all n8n instances to version 1.107.0 or later as the primary remediation
Enumerate existing Chat Trigger nodes and inspect initialMessages content for embedded scripts before re-enabling public access
Restrict workflow edit permissions to trusted users to reduce the pool of accounts that can publish public chat URLs

Patch Information

The fix is included in n8n 1.107.0. See the GitHub Security Advisory GHSA-mvh4-2cm2-6hpg and the corresponding GitHub Pull Request #18148 for full patch details. The commit adds the sanitizeUserInput helper and enforces parameter type assertions via assertParamIsString and assertParamIsBoolean.

Workarounds

Disable the affected chatTrigger node until the upgrade is completed; this is the only workaround identified by the vendor
Revoke public access on any existing Chat Trigger nodes and remove associated public chat URLs from circulation

bash

# Upgrade n8n via npm
npm install -g n8n@1.107.0

# Or upgrade the Docker image
docker pull n8nio/n8n:1.107.0
docker stop n8n && docker rm n8n
docker run -d --name n8n -p 5678:5678 n8nio/n8n:1.107.0

# Verify installed version
n8n --version