CVE-2026-110849: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in n8n-io n8n
Description
CVE-2026-110849 is a stored cross-site scripting (XSS) vulnerability in n8n versions before 1.123.83, 2.41.4, and 2.42.1. The flaw exists in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. This allows a user who uploads a crafted item to execute scripts in the context of the n8n origin for anyone who previews the item, typically the owner, potentially acting with their session.
CVSS v4.0
Score 7.2high
Affected software
n8n-io
n8n
pkg:npm/n8n-io/n8nRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-110849 affects n8n versions prior to 1.123.83, 2.41.4, and 2.42.1. It is a stored cross-site scripting issue located in the file-preview modal component. The modal re-publishes binary data as an unsandboxed same-origin blob URL, enabling an attacker who uploads a maliciously crafted item to execute arbitrary scripts in the n8n origin of users who preview the item. This can lead to session hijacking or other actions performed with the victim's privileges.
Potential Impact
An attacker with the ability to upload crafted items can execute arbitrary scripts in the context of the n8n web application for users who preview the malicious item. This can result in session hijacking or unauthorized actions performed with the victim's session privileges. The vulnerability is rated with a CVSS 4.0 score of 7.2 (high severity), indicating significant risk if exploited.
Mitigation Recommendations
Fixed versions are available: upgrade to n8n version 1.123.83 or later, 2.41.4 or later, or 2.42.1 or later. Applying these updates will remediate the stored XSS vulnerability in the file-preview modal. No additional mitigation steps are indicated beyond applying the official patches.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-14T22:16:22.734Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad00a612cdf04f656ba0263
Added to database: 10/14/2026, 23:04:01 UTC
Last enriched: 10/14/2026, 23:19:21 UTC
Last updated: 10/14/2026, 23:28:16 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.