n8n versions prior to 1.123.69, 2.33.4, and 2.34.1 contain a stored XSS flaw in the Form node's completion page. The sandboxing Content‑Security‑Policy is applied only when respondWith is not set to ‘redirect’, yet responseText is always rendered as raw HTML. An authenticated member can set respondWith to ‘redirect’ via an expression while keeping a populated responseText. This causes the completion page to serve unsanitized HTML and script from the same origin, resulting in arbitrary same‑origin script execution for any visitor who submits the public form.

All installations of n8n running the listed vulnerable versions – specifically n8n‑io:n8n versions 1.123.68 or earlier, 2.33.3, and 2.34.0 – are affected. The vulnerability arises in any deployment that uses the Form node and allows an authenticated member to inject content into the responseText field.

The CVSS score of 8.4 indicates high severity, and the vulnerability permits authenticated users to craft malicious HTML that will execute for any form submitter. Although EPSS is not available, the flaw is known and a public advisory exists. The potential impact includes data exfiltration, session hijacking, or lateral movement within the same origin. The attack vector requires the attacker to be an authenticated member with access to the Form node; no additional external exposure is needed.