4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-58177

CVE-2025-58177: Stored XSS in n8n LangChain Chat Trigger Node via initialMessages Parameter

Impact

A stored Cross-Site Scripting (XSS) vulnerability was identified in the @n8n/n8n-nodes-langchain.chatTrigger node in n8n. If an authorized user configures the node with malicious JavaScript in the initialMessages field and enables public access, the script will be executed in the browser of anyone who visits the resulting public chat URL.

This vulnerability could be exploited for phishing or to steal cookies or other sensitive data from users who access the public chat link, posing a security risk.

Patches

This issue has been patched in version 1.107.0 of n8n. Users should upgrade to version 1.107.0 or later.

Workarounds

Disabling the n8n-nodes-langchain.chatTrigger node (docs)

References

#18148

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-58177

CVE-2025-58177:

4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	>= 1.24.0, < 1.107.0	1.107.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the n8n LangChain Chat Trigger Node. An authenticated n8n user can configure a chat trigger and set the initialMessages field to contain a malicious JavaScript payload. When a victim visits the public URL for this chat, the payload executes in their browser.

The root cause is the insufficient sanitization of the initialMessages parameter.

The analysis of the patch d4ef191be0b39b65efa68559a3b8d5dad2e102b2 reveals the vulnerable code path:

The ChatTrigger.webhook method in ChatTrigger.node.ts is the webhook handler. It reads the initialMessages parameter from the node's configuration using ctx.getNodeParameter('initialMessages', ''). In the vulnerable version, this raw input is only minimally processed (split by newlines) before being passed to the createPage function.
The createPage function in templates.ts receives these messages and uses JSON.stringify to embed them into a JavaScript configuration object within the generated HTML page. JSON.stringify is not sufficient for XSS prevention in this context, as a crafted payload can break out of the JavaScript string and execute arbitrary code.

The patch addresses this by introducing a sanitizeUserInput function that uses the sanitize-html library to strip all HTML tags and also removes dangerous URL schemes like javascript:. This sanitization is applied to the initialMessages before they are embedded in the HTML, effectively neutralizing the XSS threat.

Therefore, the key functions that would appear in a runtime profile during the exploitation of this vulnerability are ChatTrigger.webhook, which handles the request and retrieves the malicious input, and createPage, which constructs the vulnerable HTML page.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.