This vulnerability affects n8n across its 1.x and 2.x branches prior to versions 1.123.24, 2.10.4, and 2.12.0. The Form Node component improperly sanitizes HTML description fields and implements iframe sandbox policies that are too permissive. As a result, authenticated users who have permissions to create workflows can inject malicious scripts or manipulate redirect parameters. This can lead to stored cross-site scripting attacks or open redirect phishing attacks against users interacting with the affected workflows.

The vulnerability allows authenticated users with workflow creation permissions to perform stored XSS attacks or phishing redirects against end users. This can lead to execution of arbitrary scripts in the context of the victim's browser, potentially compromising user data or session integrity. The open redirect aspect can facilitate phishing attacks by redirecting users to malicious sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official advisories are provided, users should monitor vendor communications for updates. In the meantime, restrict workflow creation permissions to trusted users only to reduce risk.