CVE-2026-103249 n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator
Workflow authors can inject malicious scripts via Resource Locator parameters, executing arbitrary JavaScript in other users' browsers when interacting with node dropdowns.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-103249?
CVE-2026-103249 is a medium-severity cross-site scripting vulnerability in n8n-io n8n, published on 1 Oct 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor origin when other users open the node dropdown and click the external-link icon, with the payload persisting across workflow imports and shares.
Weakness: CWE-79
Which versions are affected by CVE-2026-103249?
How do I fix CVE-2026-103249?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-103249 being exploited?
There is no known exploitation of CVE-2026-103249 in the wild and no public exploit code.
Sources
Also known as GHSA-7g6m-6jgv-fqm4, GHSA-c2wp-6fgc-xjq4, MINI-2xpp-pvgf-vq8c.