CVE-2026-56358— n8n - Stored Cross-Site Scripting in Form Trigger Node
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-56358
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
n8n - Stored Cross-Site Scripting in Form Trigger Node
Source: NVD (National Vulnerability Database)
Vulnerability Description
n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerability in the Form Trigger node's CSS sanitization that allows authenticated users to inject malicious scripts. Attackers with workflow creation permissions can inject XSS payloads that execute persistently for all form visitors, enabling form hijacking and phishing attacks.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-56358
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-56358
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-56358 (2)
IV. Related Vulnerabilities
Same product: n8n
- CVE-2026-56777
n8n - AST Validator Bypass in Python Code Node - CVE-2026-56350
n8n - SSO Enforcement Bypass via API - CVE-2026-56356
n8n - Stored Cross-Site Scripting in Chat Trigger Node Custo - CVE-2026-56351
n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL - CVE-2026-44792
n8n: Source Control Pull SQL Injection
Same vendor: n8n
- CVE-2026-56777
n8n - AST Validator Bypass in Python Code Node - CVE-2026-56356
n8n - Stored Cross-Site Scripting in Chat Trigger Node Custo - CVE-2026-56350
n8n - SSO Enforcement Bypass via API - CVE-2026-56351
n8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL - CVE-2026-56357
n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Veri
Same weakness: CWE-79
- CVE-2026-57678
WordPress Slider Revolution plugin 7.0.0-7.0.16 - Cross Site - CVE-2026-57764
WordPress Surbma | Yoast SEO Breadcrumb Shortcode plugin <= - CVE-2026-57763
WordPress Structured Content plugin <= 1.7.0 - Cross Site Sc - CVE-2026-57762
WordPress Simple URLs plugin <= 151 - Cross Site Scripting ( - CVE-2026-57755
WordPress Mosaic Gallery – Advanced Gallery plugin <=
V. Comments for CVE-2026-56358
No comments yet