CVE-2026-77072: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in n8n-io n8n

CVE-2026-77072 is a stored cross-site scripting vulnerability in n8n's Form node completion page. The issue occurs because the Content-Security-Policy sandbox is conditionally applied based on the respondWith parameter, but responseText is always rendered as raw HTML. An authenticated user can manipulate respondWith to 'redirect' and supply malicious HTML/script in responseText, resulting in unsanitized content served from the n8n origin. This allows script execution in the context of any visitor submitting the public form, potentially compromising their session.

This vulnerability allows an authenticated user to inject malicious scripts into the Form node's completion page, which are then executed in the browser of any visitor submitting the affected public form. This can lead to session hijacking, unauthorized actions, or other impacts typical of stored cross-site scripting attacks. The vulnerability affects confidentiality and integrity of user sessions interacting with the public form.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, avoid using the Form node's completion page with respondWith set to 'redirect' in environments where untrusted users can submit forms. Monitor vendor communications for patches or updates addressing this vulnerability.