{"id":"EUVD-2026-38754","revision":"4feb437214c04996865cf8323c091836","records":[{"revision":"4feb437214c04996865cf8323c091836","observedAt":"2026-10-28T08:14:49.538+00:00","statement":{"source":"euvd","id":"EUVD-2026-38754","aliases":["CVE-2026-56358"],"title":"n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerability in the Form Trigger node's CSS sanitization that allows authenticated users to inject malicious sc…","description":"n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a stored cross-site scripting vulnerability in the Form Trigger node's CSS sanitization that allows authenticated users to inject malicious scripts. Attackers with workflow creation permissions can inject XSS payloads that execute persistently for all form visitors, enabling form hijacking and phishing attacks.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","score":5.1,"severity":null}],"references":["https://github.com/n8n-io/n8n/security/advisories/GHSA-q4fm-pjq6-m63g","https://www.vulncheck.com/advisories/n8n-stored-cross-site-scripting-in-form-trigger-node"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38754","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 24, 2026, 11:53:19 AM","dateUpdated":"Jun 24, 2026, 4:01:44 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-38754","identifiers":["EUVD-2026-38754","CVE-2026-56358"]},"retained":false,"historicalAffected":[]}],"coverage":[]}