{"id":"EUVD-2026-38460","enisaUuid":"f6a68b15-bf97-3552-857a-517454f43d6b","description":"n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers, enabling reflected XSS in the n8n origin when a logged-in user visits a crafted URL. This vulnerability is fixed in 2.24.0.","datePublished":"Jun 23, 2026, 3:32:06 PM","dateUpdated":"Jun 24, 2026, 1:52:23 PM","baseScore":6.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-h86q-fx34-gfjr\n","aliases":"CVE-2026-54303\nGHSA-h86q-fx34-gfjr\n","assigner":"GitHub_M","epss":0.23,"enisaIdProduct":[{"id":"73f87e73-c538-32a4-8a17-12a353675f47","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 2.24.0"}],"enisaIdVendor":[{"id":"d34cbbff-06c3-3e35-bf4c-11cd2212e25b","vendor":{"name":"n8n-io"}}],"enisaIdVulnerability":[{"id":"047933c4-b2c1-3fd9-9993-6df1b368cb8b","vulnerability":{"id":"CVE-2026-54303","description":"n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers, enabling reflected XSS in the n8n origin when a logged-in user visits a crafted URL. This vulnerability is fixed in 2.24.0.","datePublished":"Jun 23, 2026, 3:32:06 PM","dateUpdated":"Jun 24, 2026, 1:52:23 PM","status":"PUBLISHED","baseScore":6.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-h86q-fx34-gfjr\n","enisa_id":"EUVD-2026-38460\n","assigner":"GitHub_M","epss":0.23,"dataProcessed":"Nov 3, 2026, 7:16:37 AM","vulnerabilityProduct":[{"id":"cba2d29c-f3df-3204-97a0-06ec1c72fed3","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 2.24.0"}],"vulnerabilityVendor":[{"id":"75f2696f-14e0-32e0-8aee-7edc0a9cff53","vendor":{"name":"n8n-io"}}]}},{"id":"7c0d1ec7-1eee-30f3-8b04-7ed708ee2c01","vulnerability":{"id":"GHSA-h86q-fx34-gfjr","description":"n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints","datePublished":"Jun 16, 2026, 10:39:16 PM","dateUpdated":"Jul 20, 2026, 1:39:44 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-h86q-fx34-gfjr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54303\nhttps://github.com/n8n-io/n8n\n","enisa_id":"EUVD-2026-38460\n","aliases":"GHSA-h86q-fx34-gfjr\nCVE-2026-54303\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"21b52f7e-c0b4-3d73-8ede-956cb92cf654","advisory":{"id":"NCSC-2026-0212","description":"Kwetsbaarheden verholpen in n8n workflow automation platform","datePublished":"Jun 29, 2026, 8:02:42 AM","dateUpdated":"Jun 29, 2026, 8:02:42 AM","baseScore":0.0,"references":"","aliases":"CVE-2026-54301\nCVE-2026-54302\nCVE-2026-54304\nCVE-2026-54305\nCVE-2026-54306\nCVE-2026-54307\nCVE-2026-54308\nCVE-2026-54309\nCVE-2026-54310\nCVE-2026-54311\nCVE-2026-54312\nCVE-2026-54313\nCVE-2026-54314\nCVE-2026-54303\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"9b0181f2-7f6b-3f30-80cf-cc01cf736196","product":{"name":"n8n","vendor":{"name":"n8n-io"}}}]}}]}