CVE-2026-103249: n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor origin when other users open the node dropdown and click the external-link icon, with the payload persisting across workflow imports and shares.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.80 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.39.6 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.40.1
Event History
Frequently Asked Questions
Who can exploit this issue, and what user action is required?
A workflow author with permission to create or modify a workflow can place a malicious script URL in a Resource Locator parameter. The script executes in another user's editor session only when that user opens the affected node's dropdown and clicks its external-link icon.
Which deployments and versions are affected?
Affected versions are n8n releases before 1.123.80, versions from 2.0.0 before 2.39.6, and versions from 2.40.0 before 2.40.1. The issue is relevant where users can open workflows authored by other users, including workflows received through imports or shares.
What is the impact if the payload executes?
The malicious URL can execute arbitrary JavaScript in the n8n editor origin of the user who clicks the external-link icon. The vulnerability crosses the security context because the executing user may differ from the workflow author.
Can malicious workflows remain dangerous after being moved between environments?
Yes. The payload persists across workflow imports and shares, so imported or shared workflows may retain a malicious Resource Locator link. Review workflows from untrusted authors before opening affected node dropdown links.
What should be done if upgrading cannot happen immediately?
Avoid opening external-link icons in Resource Locator dropdowns for workflows from untrusted or unreviewed authors. Restrict who can author, import, and share workflows until an affected version can be upgraded.