CVE-2026-77072: n8n before 1.123.69 Stored XSS via Form Completion Page
n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An authenticated member could set respondWith to 'redirect' via an expression while keeping responseText populated, causing the completion page to serve unsanitized HTML and script from the n8n origin. Any visitor who submitted the resulting public form would have that script execute same-origin with their session.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are n8n releases before 1.123.69, 2.33.4, and 2.34.1. The issue applies to Form nodes whose completion-page configuration can be modified by an authenticated member.
What does an attacker need to exploit this issue?
The attacker needs authenticated member access to configure a Form node. They must set respondWith to redirect through an expression while leaving responseText populated.
Who is exposed once a malicious form is configured?
Any visitor who submits the affected public form can have attacker-supplied script execute from the n8n origin with that visitor's session. The visitor does not need to be an authenticated member to trigger the form submission.
How can I identify potentially malicious form configurations?
Review Form nodes for completion-page settings where respondWith is set to redirect through an expression and responseText remains populated. These settings match the condition that causes raw responseText to be served without the intended sandboxing Content-Security-Policy.