The vulnerability is a stored cross‑site scripting flaw located in the CSS sanitization logic of n8n's Form Trigger node. By exploiting it, attackers who can create or edit workflows can embed arbitrary JavaScript, which then executes every time the corresponding form is visited. This allows attackers to hijack form sessions, collect credentials, inject phishing interfaces, or deface the interface.

This issue affects the n8n automation platform. Users running n8n 1.x earlier than 1.123.25 or n8n 2.x earlier than 2.11.2 are vulnerable. The vulnerability is addressed in later releases, including 2.12.0.

The CVSS score is 5.1, indicating a moderate risk. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, exploitation likelihood is unclear. The flaw requires authentication with workflow‑creation rights; attackers can then persistently inject malicious scripts into form visitor browsers. The exploitation does not provide remote code execution but enables persistent client‑side attacks such as phishing and credential theft.