CVE-2026-77072 is a stored cross-site scripting vulnerability affecting n8n versions prior to 1.123.69, 2.33.4, and 2.34.1. The Form node's completion page applies a sandboxing Content-Security-Policy only when respondWith is not set to 'redirect'. However, responseText is always rendered as raw HTML. An authenticated member can set respondWith to 'redirect' via an expression while keeping responseText populated, causing the completion page to serve unsanitized HTML and script from the n8n origin. This results in script execution in the context of the n8n web application for any visitor who submits the affected public form.

An attacker with authenticated access can craft a form that, when submitted by any visitor, executes arbitrary scripts in the context of the n8n origin. This can lead to session hijacking, unauthorized actions, or other malicious behaviors executed with the privileges of the victim's session. The vulnerability has a high CVSS 4.0 score of 8.4, indicating significant impact due to network attack vector, low attack complexity, no privileges required beyond authentication, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to prevent exploitation and avoid using the Form node's completion page with respondWith set to 'redirect' combined with untrusted responseText content.