CVE-2026-54303 is a reflected cross-site scripting vulnerability (CWE-79) in the n8n open source workflow automation platform. Specifically, in versions before 2.24.0, an endpoint used by the Meta and Microsoft Teams trigger nodes reflects a query parameter directly into the HTTP response without sanitization or the use of Content-Security-Policy headers. This flaw enables an attacker to execute arbitrary scripts in the context of the n8n origin when a logged-in user visits a specially crafted URL. The vulnerability has a CVSS 4.0 base score of 6.8 (medium severity) and is fixed in version 2.24.0.

Exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the n8n web application for authenticated users. This can lead to actions such as session hijacking, unauthorized actions on behalf of the user, or exposure of sensitive information within the application context. However, exploitation requires the victim to be logged in and to visit a maliciously crafted URL.

Upgrade n8n to version 2.24.0 or later, where this reflected XSS vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data. Patch status is confirmed by the vendor stating the fix is in 2.24.0.