The vulnerability is a stored XSS in the file‑preview modal of n8n before 1.123.83, 2.41.4, and 2.42.1. The flaw arises when binary data is re‑served as an unsandboxed same‑origin blob URL, allowing an attacker who uploads a crafted file to execute arbitrary script in the context of any user who previews that file. The attacker can then act with the victim’s session, potentially redirecting, exfiltrating data, or modifying configuration.

Affected products are n8n from n8n‑io across all supported versions prior to 1.123.83, 2.41.4, and 2.42.1. These releases are available for self‑hosted and SaaS deployments. The issue applies to any instance running these versions where untrusted users can upload binary files and preview them.

The CVSS score of 7.2 places the vulnerability in the high‑medium range, and the EPSS score is not available, so the current exploitation probability is uncertain. The flaw is not listed in CISA’s KEV catalog, indicating no known public exploit. The attack vector is likely local to the upload process: an attacker uploads a malicious file and then persuades or simply waits for a privileged user to preview it, triggering the stored script in the same‑origin context. No authentication bypass or remote code execution is reported, but the XSS payload can leverage the victim’s session to manipulate the application.