CVE-2025-61914
n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox
Description
n8n is an open source workflow automation platform. Prior to version 1.114.0, a stored Cross-Site Scripting (XSS) vulnerability may occur in n8n when using the “Respond to Webhook” node. When this node responds with HTML content containing executable scripts, the payload may execute directly in the top-level window, rather than within the expected sandbox introduced in version 1.103.0. This behavior can enable a malicious actor with workflow creation permissions to execute arbitrary JavaScript in the context of the n8n editor interface. This issue has been patched in version 1.114.0. Workarounds for this issue involve restricting workflow creation and modification privileges to trusted users only, avoiding use of untrusted HTML responses in the “Respond to Webhook” node, and using an external reverse proxy or HTML sanitizer to filter responses that include executable scripts.
INFO
Published Date :
Dec. 26, 2025, 10:15 p.m.
Last Modified :
Oct. 13, 2026, 10:10 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update n8n to version 1.114.0 or higher.
- Restrict workflow creation to trusted users.
- Avoid untrusted HTML in the "Respond to Webhook" node.
- Sanitize external responses using a proxy.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-61914.
| URL | Resource |
|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-58jc-rcg5-95f3 | Patch Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-61914 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-61914
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-61914 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-61914 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 13, 2026
Action Type Old Value New Value Added Translation Title: n8n, Description: n8n es una plataforma de automatización de flujos de trabajo de código abierto. Antes de la versión 1.114.0, puede ocurrir una vulnerabilidad de cross-site scripting (XSS) almacenado en n8n al usar el nodo 'Respond to Webhook'. Cuando este nodo responde con contenido HTML que contiene scripts ejecutables, la carga útil puede ejecutarse directamente en la ventana de nivel superior, en lugar de dentro del sandbox esperado introducido en la versión 1.103.0. Este comportamiento puede permitir a un actor malicioso con permisos de creación de flujos de trabajo ejecutar JavaScript arbitrario en el contexto de la interfaz del editor de n8n. Este problema ha sido parcheado en la versión 1.114.0. Las soluciones alternativas para este problema implican restringir los privilegios de creación y modificación de flujos de trabajo solo a usuarios de confianza, evitar el uso de respuestas HTML no confiables en el nodo 'Respond to Webhook', y usar un proxy inverso externo o un saneador de HTML para filtrar las respuestas que incluyen scripts ejecutables. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'n8n-io', 'product': 'n8n', 'versions': [{'status': 'affected', 'version': '< 1.114.0'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-61914', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2025-12-26T21:54:28.419361Z'} -
Initial Analysis by [email protected]
Dec. 31, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Added CPE Configuration OR *cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:* versions up to (excluding) 1.114.0 Added Reference Type GitHub, Inc.: https://github.com/n8n-io/n8n/security/advisories/GHSA-58jc-rcg5-95f3 Types: Patch, Vendor Advisory -
New CVE Received by [email protected]
Dec. 26, 2025
Action Type Old Value New Value Added Description n8n is an open source workflow automation platform. Prior to version 1.114.0, a stored Cross-Site Scripting (XSS) vulnerability may occur in n8n when using the “Respond to Webhook” node. When this node responds with HTML content containing executable scripts, the payload may execute directly in the top-level window, rather than within the expected sandbox introduced in version 1.103.0. This behavior can enable a malicious actor with workflow creation permissions to execute arbitrary JavaScript in the context of the n8n editor interface. This issue has been patched in version 1.114.0. Workarounds for this issue involve restricting workflow creation and modification privileges to trusted users only, avoiding use of untrusted HTML responses in the “Respond to Webhook” node, and using an external reverse proxy or HTML sanitizer to filter responses that include executable scripts. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N Added CWE CWE-79 Added Reference https://github.com/n8n-io/n8n/security/advisories/GHSA-58jc-rcg5-95f3