The Form Node accepts unescaped HTML in its description field and applies an overly permissive iframe sandbox policy, creating a stored cross‑site scripting (XSS) vulnerability and an open redirect flaw. When a workflow is executed that contains a maliciously crafted description, the payload is rendered in the browser of any user who views the workflow. The embedded scripts can steal session cookies or perform other client‑side attacks, while the open redirect allows an attacker to embed a URL that can lure users to malicious sites. Both behaviors are classified as CWE‑79.

All n8n installations running a pre‑1.123.24 release on the 1.x branch or a pre‑2.10.4 or pre‑2.12.0 release on the 2.x branch are affected. These deployments run on Node.js and use the Form Node within workflows. Any user who has the privilege to create or edit a workflow can exploit the vulnerability by injecting malicious content into the description field of a Form Node.

The CVSS score of 5.1 indicates moderate severity. The EPSS score of < 1 % shows that, at the time of analysis, exploitation is unlikely, but the flaw remains exploitable. Attackers need authenticated workflow modification rights; once a compromised workflow is run, the XSS or open redirect payload will execute in the browsers of any user viewing the workflow, potentially compromising their sessions or facilitating phishing.