The vulnerability allows an authenticated user who can create or modify workflows to embed arbitrary HTML into a binary data object that the server serves inline. Because the server does not set Content-Disposition or Content-Security-Policy headers, the browser renders the HTML with full same‑origin JavaScript access. An attacker can therefore deliver a crafted URL to a more privileged user and cause that user’s browser to execute malicious JavaScript within the authenticated session. This could lead to exfiltration of workflow data, credentials, or even escalation to administrative privileges.

Affected products are the n8n open‑source workflow automation platform. Any installation running a version older than 1.123.27, 2.13.3, or 2.14.1 is vulnerable. The issue is present in all n8n releases that lack those patch versions, as indicated by the CPE entries for generic and 2.14.0. Administrators should verify the version number they are running and apply the fix when possible.

The CVSS score of 6.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low overall probability of exploitation, though the vulnerability is not listed in the CISA KEV catalog. Exploitability requires an authorized user with workflow editing rights and the ability to send a malicious link to an elevated user; the attack is performed from within the trusted network and does not need external triggering. Because the flaw can compromise confidentiality and integrity by executing arbitrary code under a higher‑privileged account, applying the vendor patch or the recommended temporary mitigations is essential.