CVE-2026-110849: n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview

Severity: high (CVSS 7.2 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-14 · updated 2026-10-15
Weakness: CWE-79

Description

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the owner, and act with their session.

Affected products

n8n-io n8n: before 1.123.83; from 2.0.0 before 2.41.4; from 2.42.0 before 2.42.1 — fixed in 1.123.83, 2.41.4, 2.42.1

How to fix

Upgrade to a fixed version: n8n-io n8n 1.123.83, 2.41.4, 2.42.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-110849 or the next vulnerability affects your stack