CVE-2026-54301 is a CWE-79 cross-site scripting vulnerability in the n8n workflow automation platform. It affects versions prior to 1.123.55, 2.25.7, and 2.26.2. The issue arises because an authenticated user with workflow edit permissions can configure a Respond to Webhook node to serve binary content with a malicious Content-Type header. This binary response path bypasses the central Content-Security-Policy sandbox header, enabling execution of attacker-controlled JavaScript in the context of the n8n origin when visited by an authenticated user. This can lead to session exposure or other impacts tied to script execution within the user's session context. The vulnerability has a CVSS v4.0 score of 7.0 (high severity) and requires user interaction and low privileges to exploit.

Successful exploitation allows an authenticated user with workflow edit access to execute arbitrary JavaScript in the n8n origin context for other authenticated users visiting the webhook. This can lead to session exposure or other client-side impacts. The vulnerability bypasses Content-Security-Policy protections due to the binary response path. It does not require elevated privileges beyond workflow edit access but does require user interaction (visiting the webhook).

This vulnerability is fixed in n8n versions 1.123.55, 2.25.7, and 2.26.2. Users should upgrade to these versions or later to remediate the issue. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the vendor advisory.