PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54303 n8n-io CVE debrief

CVE-2026-54303 is a reflected Cross-Site Scripting (XSS) vulnerability in the n8n workflow automation platform. An endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without proper sanitization or Content-Security-Policy headers. This allows an attacker to inject malicious scripts when a logged-in user visits a crafted URL. The vulnerability has a CVSS score of 6.8 and is classified as MEDIUM severity. It was published on June 23, 2026, and modified on June 25, 2026. The issue is fixed in version 2.24.0 of the n8n platform.

Vendor
n8n-io
Product
n8n
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-23
Original CVE updated
2026-06-25
Advisory published
2026-06-23
Advisory updated
2026-06-25

Who should care

Security teams and administrators responsible for n8n workflow automation platforms should be aware of this vulnerability. Specifically, those using versions prior to 2.24.0 are at risk and should prioritize upgrading to the patched version. Additionally, users who have integrated n8n with Microsoft Teams or use the Meta trigger node may be particularly affected.

Technical summary

The vulnerability exists in the Meta and Microsoft Teams trigger nodes of the n8n platform. When a logged-in user visits a specially crafted URL, an attacker can inject malicious scripts into the HTTP response. This is possible because the endpoint reflects a query parameter without proper sanitization or Content-Security-Policy headers. The CVSS:4.0 vector for this vulnerability is AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. The weakness associated with this vulnerability is CWE-79, Improper Neutralization of Input During Web Page Generation.

Defensive priority

This vulnerability should be prioritized for remediation due to its MEDIUM severity and potential impact on n8n users. Upgrading to version 2.24.0 or later is strongly recommended.

Recommended defensive actions

  • Upgrade n8n to version 2.24.0 or later
  • Review and sanitize user input for query parameters in affected nodes
  • Implement Content-Security-Policy headers for n8n endpoints
  • Monitor n8n instances for suspicious activity
  • Educate users on safe browsing practices when using n8n

Evidence notes

The CVE record and NVD detail provide official information about the vulnerability. The source item URL from NVD offers additional context. A mitigation or vendor reference from GitHub provides further guidance on addressing the issue.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54303 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54303

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54303 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54303

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.