{"id":"EUVD-2026-38475","enisaUuid":"e95337f6-2eb4-3ba7-92d8-8b7765b86fe8","description":"n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could configure a Respond to Webhook node to serve binary content with an attacker-controlled Content-Type. The binary response path bypassed the central Content-Security-Policy sandbox header, allowing a public webhook to execute JavaScript in the n8n origin when visited by an authenticated user, with access to that user\u0027s session. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.","datePublished":"Jun 23, 2026, 3:44:58 PM","dateUpdated":"Jun 24, 2026, 2:00:17 PM","baseScore":7.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-v733-mwr6-fgcm\n","aliases":"CVE-2026-54301\nGHSA-v733-mwr6-fgcm\n","assigner":"GitHub_M","epss":0.24,"enisaIdProduct":[{"id":"20503afb-cbd3-384c-afac-4f7e873eab3e","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.26.0, \u003c 2.26.2"},{"id":"58529cc3-fbbb-3bf9-b8cc-29c281d4193e","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0-rc.0, \u003c 2.25.7"},{"id":"60b61ef2-590a-3837-aeaf-c06c5a53b835","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 1.123.55"}],"enisaIdVendor":[{"id":"aacacb0b-8d19-3896-8e21-2c433ec135b9","vendor":{"name":"n8n-io"}}],"enisaIdVulnerability":[{"id":"be055a31-cb66-3e47-bca6-b3b08774d769","vulnerability":{"id":"GHSA-v733-mwr6-fgcm","description":"n8n: Same-Origin XSS in Respond to Webhook Node","datePublished":"Jun 16, 2026, 7:00:31 PM","dateUpdated":"Jul 20, 2026, 1:43:54 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-v733-mwr6-fgcm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54301\nhttps://github.com/n8n-io/n8n\n","enisa_id":"EUVD-2026-38475\n","aliases":"GHSA-v733-mwr6-fgcm\nCVE-2026-54301\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e73774ee-a6df-3d46-a9b7-a83955ed5211","vulnerability":{"id":"CVE-2026-54301","description":"n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could configure a Respond to Webhook node to serve binary content with an attacker-controlled Content-Type. The binary response path bypassed the central Content-Security-Policy sandbox header, allowing a public webhook to execute JavaScript in the n8n origin when visited by an authenticated user, with access to that user\u0027s session. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.","datePublished":"Jun 23, 2026, 3:44:58 PM","dateUpdated":"Jun 24, 2026, 2:00:17 PM","status":"PUBLISHED","baseScore":7.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-v733-mwr6-fgcm\n","enisa_id":"EUVD-2026-38475\n","assigner":"GitHub_M","epss":0.24,"dataProcessed":"Nov 3, 2026, 7:16:37 AM","vulnerabilityProduct":[{"id":"b964287b-09a7-3d2c-8f46-890a7da79477","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0-rc.0, \u003c 2.25.7"},{"id":"da025073-9649-301c-990d-b34487904538","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"\u003c 1.123.55"},{"id":"df1b9374-1e25-358e-9d86-fc8d28b82052","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.26.0, \u003c 2.26.2"}],"vulnerabilityVendor":[{"id":"1d79b5ee-8190-3f57-baf2-897e69341133","vendor":{"name":"n8n-io"}}]}}],"enisaIdAdvisory":[{"id":"8021f0a8-bd62-3e0a-a0b4-93d83c911111","advisory":{"id":"NCSC-2026-0212","description":"Kwetsbaarheden verholpen in n8n workflow automation platform","datePublished":"Jun 29, 2026, 8:02:42 AM","dateUpdated":"Jun 29, 2026, 8:02:42 AM","baseScore":0.0,"references":"","aliases":"CVE-2026-54301\nCVE-2026-54302\nCVE-2026-54304\nCVE-2026-54305\nCVE-2026-54306\nCVE-2026-54307\nCVE-2026-54308\nCVE-2026-54309\nCVE-2026-54310\nCVE-2026-54311\nCVE-2026-54312\nCVE-2026-54313\nCVE-2026-54314\nCVE-2026-54303\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"9b0181f2-7f6b-3f30-80cf-cc01cf736196","product":{"name":"n8n","vendor":{"name":"n8n-io"}}}]}}]}