CVE-2026-56356: n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Field

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-30 · updated 2026-10-29
Weakness: CWE-79

Description

n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. Affected releases are those before 1.123.27, the 2.0.0 through 2.13.2 line, and 2.14.0 (fixed in 1.123.27, 2.13.3, and 2.14.1). An authenticated user with permission to create or modify workflows can inject JavaScript that bypasses sanitization, resulting in stored XSS against any user who visits the public chat page.

Affected products

n8n-io n8n: before 1.123.27; from 2.0.0 before 2.13.3; 2.14.0 (and their updates) — fixed in 1.123.27, 2.13.3
n8n-io n8n: before 1.123.27; from 2.0.0-rc.0 before 2.13.3; from 2.14.0 before 2.14.1 — fixed in 1.123.27, 2.13.3, 2.14.1

How to fix

Upgrade to a fixed version: n8n-io n8n 1.123.27, 2.13.3; n8n-io n8n 1.123.27, 2.13.3, 2.14.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-56356 or the next vulnerability affects your stack