CVE-2026-54302 is a CWE-79 cross-site scripting vulnerability in the n8n workflow automation platform. It affects versions prior to 1.123.55, 2.25.7, and 2.26.2. An authenticated user with workflow edit permissions can inject malicious JavaScript by setting a crafted webhookId in the Chat Trigger. When another authenticated user visits the chat URL, the injected script executes in the context of the n8n origin with that user's session privileges, potentially leading to session hijacking or other client-side attacks. The vulnerability is resolved in the specified fixed versions.

This vulnerability allows an authenticated user with workflow edit access to inject and execute arbitrary JavaScript in the context of other authenticated users visiting the chat URL. This can lead to unauthorized actions performed with the victim's session privileges, such as session hijacking or data theft. The CVSS 4.0 base score is 7.0 (high), reflecting network attack vector, low attack complexity, no privileges required beyond workflow edit access, and high impact on confidentiality.

Upgrade n8n to version 1.123.55, 2.25.7, or 2.26.2 or later, where this vulnerability is fixed. No other mitigations are indicated or required according to the available data.