6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54303

CVE-2026-54303: n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints

n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers, enabling reflected XSS in the n8n origin when a logged-in user visits a crafted URL. This vulnerability is fixed in 2.24.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54303

CVE-2026-54303:

6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	< 2.24.0	2.24.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic reflected Cross-Site Scripting (XSS) issue affecting multiple trigger nodes in n8n: Facebook, Facebook Lead Ads, Microsoft Teams, and WhatsApp. The root cause is the same across all affected components. During the webhook verification (or 'challenge') process, these trigger nodes receive a request containing a token in a query parameter (e.g., hub.challenge or validationToken). The webhook's logic was designed to echo this token back in the HTTP response to prove control over the endpoint. However, the vulnerable versions of the code did this without explicitly setting the Content-Type header of the response. Most modern web browsers will attempt to guess the content type if it's not specified (a behavior known as 'MIME sniffing') and may render the response as HTML. An attacker could exploit this by crafting a URL where the challenge token is replaced with a malicious HTML/JavaScript payload. When a logged-in n8n user clicks this link, their browser sends the request to the n8n instance, which then reflects the malicious payload back in the response. The browser, interpreting the response as HTML, executes the script in the context of the n8n origin, giving the attacker access to the user's session, data, and capabilities within the application. The patch addresses this vulnerability by explicitly setting the Content-Type of the challenge response to text/plain. This instructs the browser to treat the response as plain text and not to interpret it as HTML, thus preventing the execution of any embedded scripts.

Vulnerable functions

FacebookTrigger.webhook

packages/nodes-base/nodes/Facebook/FacebookTrigger.node.ts

The `webhook` function in `FacebookTrigger` was vulnerable to reflected XSS. It reflected the `hub.challenge` query parameter from the URL directly into the HTTP response without setting a `Content-Type` header. This allowed an attacker to craft a URL that, when visited by a logged-in user, would execute arbitrary JavaScript in the user's browser within the context of the n8n application's origin. The patch mitigates this by setting the `Content-Type` to `text/plain`.

FacebookLeadAdsTrigger.webhook

packages/nodes-base/nodes/FacebookLeadAds/FacebookLeadAdsTrigger.node.ts

The `webhook` function in `FacebookLeadAdsTrigger` was vulnerable to reflected XSS. It reflected the `hub.challenge` query parameter from the URL directly into the HTTP response without setting a `Content-Type` header. This allowed an attacker to craft a URL that, when visited by a logged-in user, would execute arbitrary JavaScript in the user's browser within the context of the n8n application's origin. The patch mitigates this by setting the `Content-Type` to `text/plain`.

MicrosoftTeamsTrigger.webhook

packages/nodes-base/nodes/Microsoft/Teams/MicrosoftTeamsTrigger.node.ts

The `webhook` function in `MicrosoftTeamsTrigger` was vulnerable to reflected XSS. It reflected the `validationToken` query parameter from the URL directly into the HTTP response without setting a `Content-Type` header. This allowed an attacker to craft a URL that, when visited by a logged-in user, would execute arbitrary JavaScript in the user's browser within the context of the n8n application's origin. The patch mitigates this by setting the `Content-Type` to `text/plain`.

WhatsAppTrigger.webhook

packages/nodes-base/nodes/WhatsApp/WhatsAppTrigger.node.ts

The `webhook` function in `WhatsAppTrigger` was vulnerable to reflected XSS. It reflected the `hub.challenge` query parameter from the URL directly into the HTTP response without setting a `Content-Type` header. This allowed an attacker to craft a URL that, when visited by a logged-in user, would execute arbitrary JavaScript in the user's browser within the context of the n8n application's origin. The patch mitigates this by setting the `Content-Type` to `text/plain`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.