CVE-2025-52478
📋 TL;DR
A stored Cross-Site Scripting (XSS) vulnerability in n8n's Form Trigger node allows authenticated attackers to inject malicious HTML/JavaScript. This enables account takeover by stealing session cookies and browser IDs from users who interact with malicious forms. Affects n8n versions 1.77.0 through 1.98.1.
💻 Affected Systems
- n8n
📦 What is this software?
N8n by N8n
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover allowing attackers to change email addresses, disable 2FA, and gain full administrative control over n8n instances.
Likely Case
Session hijacking leading to unauthorized access to workflows, credentials, and sensitive automation data.
If Mitigated
Limited impact with proper input validation, Content Security Policy, and session management controls.
🎯 Exploit Status
Exploitation requires authenticated access; attack vectors include <iframe srcdoc> and <video><source onerror> payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.98.2
Vendor Advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-hfmv-hhh3-43f2
Restart Required: Yes
Instructions:
1. Backup n8n instance and data. 2. Update n8n to version 1.98.2 or later using npm: 'npm update -g n8n'. 3. Restart n8n service. 4. Verify version with 'n8n --version'.
🔧 Temporary Workarounds
Disable Form Trigger Node
allTemporarily disable or restrict access to Form Trigger nodes until patching.
Implement Content Security Policy
allAdd CSP headers to restrict script execution from untrusted sources.
Add 'Content-Security-Policy: default-src 'self'; script-src 'self'' to n8n web server configuration
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all form inputs
- Enable 2FA for all user accounts and monitor for suspicious account changes
🔍 How to Verify
Check if Vulnerable:
Check n8n version: if between 1.77.0 and 1.98.1 inclusive, system is vulnerable.Check Version:
n8n --versionVerify Fix Applied:
Confirm n8n version is 1.98.2 or higher and test Form Trigger node with XSS payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual HTML/JavaScript in form submissions
- Multiple failed login attempts from new locations
- Account email change events
Network Indicators:
- Outbound connections to unknown domains from n8n instance
- Unusual cookie/session token exfiltration patterns
SIEM Query:
source="n8n" AND ("iframe" OR "srcdoc" OR "onerror") AND event_type="form_submission"