The vulnerability arises from an improper enforcement of the content‑security policy on webhook responses and related HTTP endpoints. An authenticated user who can create or modify workflows can embed malicious scripts into a workflow definition. When other users interact with that workflow, the browser executes the embedded scripts with the same‑origin privileges of the victim, potentially hijacking the victim’s session and taken over the account.

n8n, an open‑source workflow automation platform provided by n8n-io. Versions prior to 1.123.2 are affected; the issue was fixed in release 1.123.2.

The CVSS base score of 8.5 classifies the flaw as high severity, yet the EPSS score below 1% indicates a very low likelihood of exploitation at the time of this assessment, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and have permission to edit workflows; therefore the vector is limited to users with workflow authoring rights. If exploited, the same‑origin script execution can capture session cookies or perform privileged actions, leading to complete account takeover. The exposure is therefore limited to users who run the crafted workflow but can result in widespread compromise if the malicious workflow is widely adopted within an organization.