CVE-2026-54303

MediumCVSS 5.4/10Last modified Oct 26, 2026

Description

n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers, enabling reflected XSS in the n8n origin when a logged-in user visits a crafted URL. This vulnerability is fixed in 2.24.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n8n-io	n8n	< 2.24.0

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-h86q-fx34-gfjrMitigation, Vendor Advisory

Timeline

Published: Jun 23, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-543047.7n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create o CVE-2026-543059.9n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, three EE endpoints used by the Dynamic Credential CVE-2026-543066.4n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollution vulnerability allowed a crafted public CVE-2026-543079.6n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, a member-level user with editor access to a share CVE-2026-543087.2n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not CVE-2026-5430910.0n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP CVE-2026-543109.9n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify wo CVE-2026-543117.7n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify wo CVE-2026-543128.5n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows cou CVE-2026-543137.7n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a maliciou CVE-2026-543147.5n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompress operation expanded attacker-controlle CVE-2026-543169.1Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname f