n8n is an open source workflow automation platform. Prior to version 1.123.2, a Cross-Site Scripting (XSS) vulnerability has been identified in the handling of webhook responses and related HTTP endpoints. Under certain conditions, the Content Security Policy (CSP) sandbox protection intended to isolate HTML responses may not be applied correctly. An authenticated user with permission to create or modify workflows could abuse this to execute malicious scripts with same-origin privileges when other users interact with the crafted workflow. This could lead to session hijacking and account takeover. This issue has been patched in version 1.123.2.

The version of the n8n Node.js Package installed on the remote host is prior to 1.122.5, or 1.123.x prior to 1.123.2.
It is, therefore, affected by a stored cross-site scripting vulnerability:

  - A cross-site scripting (XSS) vulnerability has been identified in the handling of webhook responses and related     HTTP endpoints. Under certain conditions, the Content Security Policy (CSP) sandbox protection intended to isolate     HTML responses may not be applied correctly. An authenticated user with permission to create or modify workflows     could abuse this to execute malicious scripts with same-origin privileges when other users interact with the crafted     workflow. This could lead to session hijacking and account takeover. (CVE-2026-25051)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - n8n is an open source workflow automation platform. Prior to version 1.123.2, a Cross-Site Scripting (XSS)
    vulnerability has been identified in the handling of webhook responses and related HTTP endpoints. Under
    certain conditions, the Content Security Policy (CSP) sandbox protection intended to isolate HTML
    responses may not be applied correctly. An authenticated user with permission to create or modify
    workflows could abuse this to execute malicious scripts with same-origin privileges when other users
    interact with the crafted workflow. This could lead to session hijacking and account takeover. This issue
    has been patched in version 1.123.2. (CVE-2026-25051)

ID	Name	Product	Family	Severity
298986	n8n Node.js Package < 1.122.5 / 1.123.x < 1.123.2 Stored XSS (CVE-2026-25051)	Nessus	Misc.	high
437526	SCA: security update for n8n (GHSA-825q-w924-xhgx)	Tenable Cloud Security	SCA Checks	high
437526	SCA: security update for n8n (GHSA-825q-w924-xhgx)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-25051

high

Tenable Plugins

high

high

high