CVE-2026-103249

Summary

The flaw is a stored DOM cross-site scripting vulnerability in n8n, allowing workflow authors to inject malicious scripts that can execute arbitrary JavaScript in the editor origin when other users interact with the node dropdown.

Exploitability

Exploitation requires the attacker to have control over a workflow node and the target user to open the node dropdown and click the external-link icon. Precondition is that the target user has access to the workflow.

Blast radius

If exploited, the vulnerability could lead to arbitrary JavaScript execution in the context of the editor, potentially leading to data theft or further compromise of the system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to n8n version 1.123.80 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.