A stored cross‑site scripting vulnerability exists in the markdown rendering component used throughout the n8n workflow interface, including sticky notes and other markdown‑enabled fields. An authenticated user who can create or edit workflows can embed malicious JavaScript that is executed in the browsers of any users who subsequently view the workflow. Because the scripts run with the same origin as the application, they can access session cookies and perform actions on behalf of the victim, enabling session hijacking and possible full account takeover. The underlying weakness is reflected in CWE‑79 and CWE‑80.

All installations of n8n prior to version 1.123.9 and 2.2.1 are impacted. The affected product is the open‑source workflow automation platform n8n, maintained by n8n‑io.

The vulnerability carries a CVSS score of 8.5, indicating high severity. Its EPSS score is less than 1 %, suggesting that current exploit activity is low, and it is not listed in CISA’s KEV catalog. Exploitation requires authentication with rights to create or modify workflows, after which the malicious script is delivered purely through UI interaction. While the attack is limited to users who view the compromised workflow, the potential for privilege escalation is significant, warranting prompt remediation.