n8n is an open‑source workflow automation platform. Prior to versions 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could embed arbitrary JavaScript into the Chat Trigger's generated page by setting a malicious webhookId. When another logged‑in user visits the chat URL, the injected script executes in the n8n origin using the victim’s session privileges. This stored XSS flaw (CWE‑79) allows the attacker to run code with the victim’s rights and potentially exfiltrate data or perform actions on their behalf.

The issue affects the n8n product from n8n‑io. Any installation using a version earlier than 1.123.55, 2.25.7, or 2.26.2 is vulnerable. These versions allow a workflow editor to supply a malicious webhookId that is persisted and later rendered to a logged‑in user.

The flaw carries a CVSS score of 7, indicating a high risk. While the EPSS score is not available, the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an authenticated user with workflow edit rights; the attacker must alter the webhookId field, which is stored in the chat page. Successful exploitation occurs when another logged‑in user visits the chat URL, at which point the malicious script runs with the victim’s browser context and session privileges. Because the attack vector is limited to users with adequate permissions, an organization should immediately patch or restrict those privileges.