CVE-2026-110849: n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the owner, and act with their session.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue and who is at risk?
A member who can upload a crafted binary-data item can exploit the issue. The risk is primarily to users who preview that item in the file-preview modal, typically an n8n owner, because the script runs with the previewing user's n8n session.
Does exploitation require a victim to preview the uploaded item?
Yes. The crafted item must be opened in the file-preview modal by a target user for its script to execute in that user's n8n origin.
Which versions are affected?
Versions before 1.123.83, 2.41.4, and 2.42.1 are affected.