CVE-2026-110847 n8n-io CVE debrief

Who should care

Defenders responsible for n8n deployments, especially workflow authors and users of the Chat Trigger feature, should assess exposure and prioritize verification and remediation due to the risk of stored XSS and potential for unauthorized script execution. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the vulnerability's impact on their environments and take appropriate actions.

Why it matters

Defenders should prioritize verifying exposure in n8n deployments, especially for workflow authors and users of the Chat Trigger feature, due to the risk of stored XSS and potential for unauthorized script execution.

• Potential for unauthorized script execution on instance origin
• Risk of session hijacking for signed-in visitors
• Need for verification of n8n version and exposure to Chat Trigger feature
• Priority for restricting customCss values in Chat Trigger

Technical summary

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page. Insufficiently sanitised customCss values are interpolated into the page as markup, allowing workflow authors to publish a chat without n8n user authentication whose payload executes on the instance origin, acting on the sessions of signed-in visitors.

Defensive priority

Defenders should prioritize verifying exposure in n8n deployments, especially for workflow authors and users of the Chat Trigger feature.

Recommended defensive actions

• Verify n8n version and exposure to the Chat Trigger feature
• Restrict customCss values in Chat Trigger
• Monitor for suspicious activity in n8n instances
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the stored XSS vulnerability in n8n's Chat Trigger feature. However, the corpus does not establish versions beyond those provided, exploitation, impact, or remediation, which require verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.