8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-52478

CVE-2025-52478: Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source

Impact

A stored Cross-Site Scripting (XSS) vulnerability was identified in n8n, specifically in the Form Trigger node's HTML form element. An authenticated attacker can inject malicious HTML via an <iframe> with a srcdoc payload that includes arbitrary JavaScript execution. The attacker can also inject malicious Javascript by using <video> coupled <source> using an onerror event.

While using iframe or a combination of video and source tag, this vulnerability allows for Account Takeover (ATO) by exfiltrating n8n-browserId and session cookies from authenticated users who visit a maliciously crafted form. Using these tokens and cookies, an attacker can impersonate the victim and change account details such as email addresses, enabling full control over the account—especially if 2FA is not enabled.

Patches

The issue was addressed in PR #16329. Users should upgrade to version >=1.98.2.

Workarounds

Apart from updating to the fixed version, n8n instance administrators can:

Configure a reverse proxy to serve webhook requests from a different domain [docs].
Disable or restrict use of the Form Trigger node, particularly the HTML element type.
Use a Content Security Policy (CSP) to block execution of inline scripts and disallow use of srcdoc.

References

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-52478

CVE-2025-52478:

8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	>= 1.77.0, < 1.98.2	1.98.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the n8n Form Trigger node. The root cause lies in the sanitizeHtml function, which was inadequately configured to sanitize user-provided HTML. Specifically, it allowed wildcard attributes for <iframe>, <video>, and <source> tags. This allowed an attacker to craft a form containing malicious HTML, such as an <iframe> with a srcdoc attribute containing a script, or a <video> tag with an onerror event handler.

When a victim views this malicious form, the renderFormNode function is executed. This function processes the form's structure and for any HTML elements, it passes the content to the sanitizeHtml function. Due to the flaw in sanitizeHtml, the malicious script is not removed. The renderFormNode function then includes this unsanitized HTML in the final form page, which is rendered in the victim's browser. The script then executes, allowing the attacker to steal session cookies and other sensitive data, potentially leading to account takeover.

The patch addresses this by tightening the rules in sanitizeHtml, restricting the allowed attributes and URL schemes for the vulnerable tags to a safe subset, thus preventing the injection of malicious code.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.