Webhook Responses Without the Sandbox Policy Allow Stored Cross-Site Scripting
Résumé
Impact
n8n adds a sandbox Content-Security-Policy to webhook responses so that HTML from a workflow cannot run on the n8n origin. Some response paths, such as error responses and some responses without headers, did not add this policy. A member who can create and activate workflows can serve H...
Résumé IA
Rédigé par une IA externe ; il peut contenir des erreurs. Vérifiez la description d'origine et les références ci-dessous avant d'agir.
n8nのWebhook応答でサンドボックス用のセキュリティポリシーが一部の応答に付与されず、保存型のクロスサイトスクリプティングが可能になる脆弱性です。ワークフローを作成・有効化できる利用者が、n8nのオリジン上で動くHTMLを配信でき、別の利用者がWebhookのURLを開くとそのセッションで操作される恐れがあります。影響を受けるのはn8nの1.123.85より前、2.43.5より前、2.44.1より前の版で、1.123.85、2.43.5、2.44.1以降へ更新してください。
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| npm | n8n |
< 1.123.85 |
>= 1.123.85 |
| npm | n8n |
< 2.44.1 |
>= 2.44.1 |
| npm | n8n |
< 2.43.5 |
>= 2.43.5 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
Impact
n8n adds a sandbox Content-Security-Policy to webhook responses so that HTML from a workflow cannot run on the n8n origin. Some response paths, such as error responses and some responses without headers, did not add this policy. A member who can create and activate workflows can serve HTML that runs as a page on the n8n origin. When another user opens the webhook URL, the script can act with that user's session.
Patches
The issue has been fixed in n8n versions 1.123.85, 2.44.1, and 2.43.5. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Audit active webhook workflows and review the response bodies returned by nodes operating in legacy response mode for unexpected HTML or script content.
- Apply network-level controls to restrict access to
/webhook/*routes to trusted sources only.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
Références
- GITHUB_REPO_ADVISORY n8n-io/n8n