8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25051

CVE-2026-25051: n8n Improper CSP Enforcement in Webhook Responses May Allow Stored XSS

n8n is an open source workflow automation platform. Prior to version 1.123.2, a Cross-Site Scripting (XSS) vulnerability has been identified in the handling of webhook responses and related HTTP endpoints. Under certain conditions, the Content Security Policy (CSP) sandbox protection intended to isolate HTML responses may not be applied correctly. An authenticated user with permission to create or modify workflows could abuse this to execute malicious scripts with same-origin privileges when other users interact with the crafted workflow. This could lead to session hijacking and account takeover. This issue has been patched in version 1.123.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25051

CVE-2026-25051:

8.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	>= 1.123.0, < 1.123.2	1.123.2
n8n	npm	< 1.122.5	1.122.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Cross-site Scripting (XSS) issue in n8n caused by improper enforcement of the Content Security Policy (CSP) in webhook responses. The root cause of the vulnerability lies in the isHtmlRenderedContentType function, which is responsible for determining if a given Content-Type should be rendered as HTML. Before the patch, this function did not trim whitespace from the input contentType string. This flaw allowed an attacker to bypass the security check by crafting a Content-Type header with leading or trailing spaces, such as " text/html ". When the application failed to correctly identify this as an HTML content type, it would not apply the necessary CSP sandbox protection, allowing arbitrary JavaScript to be executed in the context of the user's session. The patch addresses this by adding .trim() to the contentType string, ensuring that any whitespace is removed before the comparison is made, thus correctly identifying the content type and applying the appropriate security measures.

Vulnerable functions

isHtmlRenderedContentType

packages/core/src/html-sandbox.ts

The function `isHtmlRenderedContentType` was vulnerable because it did not trim whitespace from the `contentType` string before checking if it was a type that should be rendered as HTML. This could allow a malicious actor to bypass the check by providing a `Content-Type` with leading or trailing whitespace, leading to the execution of malicious scripts (XSS).

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.