CVE-2026-56354 Overview
CVE-2026-56354 affects the n8n workflow automation platform across its 1.x and 2.x release branches. The vulnerability resides in the Form Node component, which fails to sanitize HTML description fields and applies overly permissive iframe sandbox policies. Authenticated users holding workflow creation permissions can inject malicious scripts or manipulate redirect parameters. This enables stored cross-site scripting (XSS) attacks and phishing-style open redirects against end users interacting with rendered forms. The issue is tracked under [CWE-79] and is fixed in n8n versions 1.123.24, 2.10.4, and 2.12.0.
Critical Impact
Authenticated workflow authors can persist malicious JavaScript or redirect targets inside Form Node descriptions, exposing form consumers to session theft, credential harvesting, and phishing redirection.
Affected Products
- n8n Community edition prior to 1.123.24, 2.10.4, and 2.12.0
- n8n Enterprise edition prior to 1.123.24, 2.10.4, and 2.12.0
- Self-hosted n8n Node.js deployments on both 1.x and 2.x branches
Discovery Timeline
- 2026-07-10 - CVE-2026-56354 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-56354
Vulnerability Analysis
The Form Node in n8n renders user-supplied description content to end users who submit or view workflow-triggered forms. The node accepts HTML in the description field but does not enforce output encoding or a sanitization allowlist. It also embeds form content inside an iframe whose sandbox policy is broader than required for rendering form UI. The combined weaknesses allow persisted markup to execute JavaScript in the context of the rendered form origin. A secondary flaw permits attacker-controlled values to influence redirect parameters, enabling arbitrary external destinations after form interaction.
Root Cause
The root cause is missing output sanitization on the Form Node description field combined with an iframe sandbox attribute that grants execution capabilities beyond what static form rendering requires. Redirect parameters are not validated against an allowlist of internal destinations, permitting off-domain navigation targets.
Attack Vector
Exploitation requires an authenticated account with workflow creation rights. The attacker builds a workflow containing a Form Node, embeds crafted HTML or a JavaScript payload in the description field, and publishes the form URL. When a victim opens the form, the injected script runs inside the form origin. Alternatively, the attacker crafts a redirect parameter that transports the victim to an external phishing page after submission. Refer to the GitHub Security Advisory GHSA-w673-8fjw-457c and the VulnCheck Advisory on n8n for additional technical detail.
No verified public proof-of-concept code is available at this time. The vulnerability mechanism is described in prose above rather than reconstructed as synthetic exploit code.
Detection Methods for CVE-2026-56354
Indicators of Compromise
- Form Node description fields containing <script>, onerror=, onload=, or javascript: sequences within stored workflow definitions.
- Outbound HTTP redirects from n8n form submission endpoints to unexpected external domains.
- Workflow revisions authored by low-privilege accounts that introduce HTML markup into Form Node descriptions.
Detection Strategies
- Audit the n8n database or workflow export JSON for Form Node entries whose description property contains raw HTML tags or event-handler attributes.
- Review web server and reverse-proxy logs for form endpoint responses that set Location headers pointing to unapproved hostnames.
- Correlate n8n audit logs for workflow create and update events with subsequent form access events from external users.
Monitoring Recommendations
- Enable and centralize n8n audit logging, forwarding workflow modification events to a SIEM for retention and correlation.
- Alert on any new or modified Form Nodes authored by non-administrator users pending manual review.
- Monitor content security policy (CSP) violation reports from browsers rendering n8n form pages for evidence of injected inline script execution.
How to Mitigate CVE-2026-56354
Immediate Actions Required
- Upgrade n8n to version 1.123.24, 2.10.4, or 2.12.0 depending on the deployed branch.
- Inventory existing workflows and remove or sanitize any Form Node description fields containing HTML markup or unexpected redirect parameters.
- Restrict workflow creation permissions to trusted operators until upgrades are complete.
Patch Information
The n8n maintainers released fixes in versions 1.123.24, 2.10.4, and 2.12.0. The patches sanitize HTML in the Form Node description field and tighten the iframe sandbox policy applied to rendered forms. Full remediation details are published in the GitHub Security Advisory GHSA-w673-8fjw-457c.
Workarounds
- Limit the workflow:create and workflow:update roles to a minimal set of trusted administrators.
- Place n8n form endpoints behind a reverse proxy that enforces a strict Content Security Policy blocking inline scripts and untrusted redirect destinations.
- Disable public exposure of Form Node trigger URLs until upgrade is applied.
# Upgrade example for self-hosted n8n via npm
npm install -g n8n@1.123.24
# Or for the 2.x branch
npm install -g n8n@2.12.0
# Verify installed version
n8n --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
