GCVE-110-NCSC-2026-212

Advisory PublishedCVSS 7.6/10

Vulnetix · Advisory published June 29, 2026

An authenticated user with workflow edit access in n8n versions prior to 1.123.55, 2.25.7, and 2.26.2 could exploit a Respond to Webhook node to bypass Content-Security-Policy and execute JavaScript in the n8n origin.

Download JSON Open in Console

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CWE-863Incorrect AuthorizationCWE-290Authentication Bypass by SpoofingCWE-306Missing Authentication for Critical FunctionCWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CWE-488Exposure of Data Element to Wrong SessionCWE-409Improper Handling of Highly Compressed Data (Data Amplification)

Risk Scores

CVSS 3.1

7.6/10

High · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Affected Products

Vendor	Product	Versions	Platforms
n8n	vers:unknown/*	—	—

Aliases

CVE-2026-54301 CVE-2026-54302 CVE-2026-54303 CVE-2026-54304 CVE-2026-54305 CVE-2026-54306 CVE-2026-54307 CVE-2026-54308 CVE-2026-54309 CVE-2026-54310 CVE-2026-54311 CVE-2026-54312 CVE-2026-54313 CVE-2026-54314

References

advisory

Browse GCVE Records

73,040 records in the GCVE database · Updated July 15, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON