CVE-2026-110849
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the…
- Risk score
- 46/100
- CVSS
- 7.2 v4.0
- Exploit chance (30 days)
- 0.2%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the owner, and act with t…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.123.83, 2.41.4 or 2.42.1 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.2 high
References
Original description
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the owner, and act with their session.
Last activity 14 Oct 2026. Patch Forecast updates every hour.