CVE-2026-25054

n8n is an open source workflow automation platform. Prior to versions 1.123.9 and 2.2.1, a Cross-Site Scripting (XSS) vulnerability existed in a markdown rendering component used in n8n's interface, including workflow sticky notes and other areas that support markdown content. An authenticated user with permission to create or modify workflows could abuse this to execute scripts with same-origin privileges when other users interact with a maliciously crafted workflow. This could lead to session hijacking and account takeover. This issue has been patched in versions 1.123.9 and 2.2.1.

An attacker with a low-privilege n8n account (e.g., a contractor or shared team account) creates a workflow and embeds a JavaScript payload in a sticky note using a markdown rendering bypass. The payload exfiltrates the victim's session cookie to an attacker-controlled endpoint. An admin or senior developer opens the workflow for review — standard collaborative behavior. The script executes in their browser with same-origin privileges, sends the session token to the attacker, who then authenticates as the admin. The attacker navigates to n8n Credentials, exports all stored secrets (OpenAI API key, Pinecone token, Postgres credentials), and modifies existing AI agent workflows to include data exfiltration nodes or malicious tool call injections. The compromise of the AI pipeline is silent and persistent until the workflow modification is noticed.