CVE-2026-56356: n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Field
n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field due to a misconfiguration of the sanitize-html library. Affected releases are those before 1.123.27, the 2.0.0 through 2.13.2 line, and 2.14.0 (fixed in 1.123.27, 2.13.3, and 2.14.1). An authenticated user with permission to create or modify workflows can inject JavaScript that bypasses sanitization, resulting in stored XSS against any user who visits the public chat page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.123.27 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.13.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.14.1 - Compensating control
If you use the n8n Chat Trigger node, restrict authenticated users’ permissions so only trusted users can create or modify workflows (since the vulnerability requires permission to create/modify workflows to inject JavaScript into the Chat Trigger node Custom CSS field).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56356?
CVE-2026-56356 has a medium severity rating of 5.1.
How do I fix CVE-2026-56356?
To fix CVE-2026-56356, update to n8n version 1.123.27, 2.13.3, or 2.14.1.
What type of vulnerability is identified in CVE-2026-56356?
CVE-2026-56356 is a stored cross-site scripting (XSS) vulnerability.
Which n8n versions are affected by CVE-2026-56356?
n8n versions before 1.123.27, 2.0.0 through 2.13.2, and 2.14.0 are affected by CVE-2026-56356.
What causes the vulnerability in CVE-2026-56356?
The vulnerability in CVE-2026-56356 is caused by a misconfiguration of the sanitize-html library in the Chat Trigger node's Custom CSS field.