CVE-2026-56358: n8n Form Trigger Node XSS Vulnerability

CVE-2026-56358 Overview

CVE-2026-56358 is a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting the n8n workflow automation platform. The flaw resides in the Form Trigger node's Cascading Style Sheets (CSS) sanitization logic. Authenticated users with workflow creation permissions can inject malicious scripts that execute persistently in the browsers of all form visitors. Successful exploitation enables form hijacking and phishing attacks against end users interacting with affected forms. The vulnerability is fixed in n8n versions 1.123.25 (1.x branch), 2.11.2 (2.x branch), and 2.12.0.

Critical Impact
Authenticated attackers with workflow creation permissions can persistently inject scripts into Form Trigger pages, hijacking sessions and harvesting credentials from every visitor.

Affected Products

n8n versions prior to 1.123.25 (1.x branch)
n8n versions prior to 2.11.2 (2.x branch)
Fix included in n8n 2.12.0

Discovery Timeline

2026-06-24 - CVE-2026-56358 published to the National Vulnerability Database
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56358

Vulnerability Analysis

The vulnerability exists in the Form Trigger node, a component that allows n8n workflows to be triggered by user-submitted web forms. The node accepts custom CSS to style the rendered form. The CSS sanitization routine fails to adequately filter constructs that can be interpreted as executable script content when rendered in the form page. Because submitted form pages are served to any visitor with the form URL, the injected payload executes in every visitor's browser session.

The attacker must be authenticated and possess workflow creation permissions, which limits exploitation to insiders or attackers who have already compromised an authoring account. Once a malicious workflow is saved, the payload is stored server-side and delivered to all subsequent form visitors, making this a persistent (stored) XSS rather than a reflected variant.

Root Cause

The root cause is insufficient sanitization of user-supplied CSS within the Form Trigger node. The sanitizer does not strip or neutralize all script-bearing constructs before the CSS is embedded in the rendered HTML response, violating the input validation contract expected for content rendered to untrusted browsers [CWE-79].

Attack Vector

An authenticated attacker with permission to create or edit workflows configures a Form Trigger node and supplies crafted CSS containing an XSS payload. After saving the workflow, the attacker distributes the public form URL or waits for legitimate visitors. Each visitor's browser parses the malicious markup and executes attacker-controlled JavaScript in the context of the n8n form origin. This enables session cookie theft, credential capture via overlay phishing forms, redirection to attacker infrastructure, and arbitrary DOM manipulation of the form interface.

Technical details are available in the GitHub Security Advisory GHSA-q4fm-pjq6-m63g and the VulnCheck Advisory.

Detection Methods for CVE-2026-56358

Indicators of Compromise

Form Trigger node configurations containing CSS with expression(, url(javascript:, </style>, <script, or HTML-breaking sequences
Outbound requests from form visitor browsers to unexpected external domains after loading an n8n form page
Unexpected workflow modifications by accounts that do not normally author Form Trigger workflows
Form pages returning HTML where injected <style> content contains executable script constructs

Detection Strategies

Audit all Form Trigger node CSS fields across stored workflows and flag entries containing HTML tag characters or JavaScript-related keywords
Review n8n audit logs for workflow create and update events targeting Form Trigger nodes, correlating with user role assignments
Inspect HTTP responses from public form endpoints for unsanitized script content within <style> blocks

Monitoring Recommendations

Enable a Content Security Policy (CSP) on the n8n deployment and monitor CSP violation reports for inline script execution attempts
Log and alert on creation of new workflow authoring accounts and privilege changes that grant workflow creation rights
Track outbound DNS and HTTP traffic from clients that have visited n8n form URLs for connections to unknown third-party domains

How to Mitigate CVE-2026-56358

Immediate Actions Required

Upgrade n8n to version 1.123.25, 2.11.2, or 2.12.0 or later, depending on the deployed branch
Audit existing Form Trigger nodes for malicious CSS content and remove any suspicious entries before upgrade completion
Review and restrict the user population holding workflow creation permissions to trusted authors only
Rotate session tokens and credentials that may have been exposed through publicly accessible form pages

Patch Information

The issue is patched in n8n 1.123.25 for the 1.x release line and 2.11.2 for the 2.x release line. The fix is also included in 2.12.0. Patch details are documented in GitHub Security Advisory GHSA-q4fm-pjq6-m63g. Self-hosted operators should follow the standard upgrade procedure for their deployment method (Docker, npm, or desktop).

Workarounds

Disable the Form Trigger node functionality if upgrading immediately is not feasible
Restrict workflow creation and edit permissions to a minimal set of vetted administrators until patching is complete
Place affected n8n form endpoints behind a web application firewall (WAF) configured to block common XSS payload patterns in rendered responses
Enforce a strict Content Security Policy that disallows inline scripts on form-serving routes

bash

# Upgrade n8n via npm to a patched release
npm install -g n8n@1.123.25

# Or upgrade via Docker to the 2.x patched release
docker pull n8nio/n8n:2.11.2
docker stop n8n && docker rm n8n
docker run -d --name n8n -p 5678:5678 n8nio/n8n:2.11.2