n8nのWebhook応答で保存型クロスサイトスクリプティングの恐れ
Summary
n8nのWebhook応答でサンドボックス用のセキュリティポリシーが一部の応答に付与されず、保存型のクロスサイトスクリプティングが可能になる脆弱性です。ワークフローを作成・有効化できる利用者が、n8nのオリジン上で動くHTMLを配信でき、別の利用者がWebhookのURLを開くとそのセッションで操作される恐れがあります。影響を受けるのはn8nの1.123.85より前、2.43.5より前、2.44.1より前の版で、1.123.85、2.43.5、2.44.1以降へ更新してください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
n8nのWebhook応答でサンドボックス用のセキュリティポリシーが一部の応答に付与されず、保存型のクロスサイトスクリプティングが可能になる脆弱性です。ワークフローを作成・有効化できる利用者が、n8nのオリジン上で動くHTMLを配信でき、別の利用者がWebhookのURLを開くとそのセッションで操作される恐れがあります。影響を受けるのはn8nの1.123.85より前、2.43.5より前、2.44.1より前の版で、1.123.85、2.43.5、2.44.1以降へ更新してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| npm | n8n |
< 1.123.85 |
>= 1.123.85 |
| npm | n8n |
< 2.44.1 |
>= 2.44.1 |
| npm | n8n |
< 2.43.5 |
>= 2.43.5 |
Original description The description as published by the source.
Impact
n8n adds a sandbox Content-Security-Policy to webhook responses so that HTML from a workflow cannot run on the n8n origin. Some response paths, such as error responses and some responses without headers, did not add this policy. A member who can create and activate workflows can serve HTML that runs as a page on the n8n origin. When another user opens the webhook URL, the script can act with that user's session.
Patches
The issue has been fixed in n8n versions 1.123.85, 2.44.1, and 2.43.5. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Audit active webhook workflows and review the response bodies returned by nodes operating in legacy response mode for unexpected HTML or script content.
- Apply network-level controls to restrict access to
/webhook/*routes to trusted sources only.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
References
- GITHUB_REPO_ADVISORY n8n-io/n8n