CVE-2026-118648 n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-118648?
CVE-2026-118648 is a high-severity vulnerability in n8n-io n8n, published on 28 Oct 2026.
Official description
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy. Authenticated members who can create and activate workflows can serve HTML that runs on the n8n origin, letting scripts act with the session of users who open the webhook URL.
Weakness: CWE-79
Which versions are affected by CVE-2026-118648?
How do I fix CVE-2026-118648?
No fix has been published for CVE-2026-118648 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-118648 being exploited?
There is no known exploitation of CVE-2026-118648 in the wild and no public exploit code.
Sources
Also known as GHSA-j6xc-9gw8-942r, GHSA-mp7q-23hg-35cf.