GHSA-3c7f-5hgj-h279

What it actually does

The Chat Trigger node’s Custom CSS input is not adequately sanitized before it is stored and rendered into the chat interface. Attacker-controlled styling can therefore introduce script that runs in the browser of anyone who loads the affected chat page, in the origin of the n8n application. Impact is stored cross-site scripting: session tokens and cookies available to that origin can be read or misused, authenticated n8n API calls can be issued as the victim, and UI or workflow state visible to that user can be altered. The flaw does not by itself grant unauthenticated remote code execution on the n8n host.

Why it matters to the business

Anyone who can edit a workflow, import a shared workflow, or abuse a contributor account can persist malicious chat styling that later hijacks operators, builders, or end users who open the chat UI. That can expose connected-service credentials, change automations, and undermine customer-facing chat experiences. n8n is a widely deployed npm-based automation platform; unpatched 1.x and 2.x instances remain exposed more than 200 days after disclosure. The issue is not in CISA KEV, is not associated with ransomware campaigns, and has no public exploit maturity, so mass opportunistic exploitation is not indicated—but any instance that accepts untrusted workflow edits or imports should still be treated as at risk until upgraded.

How an attack unfolds

An attacker first needs a way to place content into a Chat Trigger node’s Custom CSS field. Typical routes are legitimate workflow-edit rights, social engineering a builder to import a malicious workflow JSON, or compromise of a low-privilege contributor. The unsanitized CSS is saved with the workflow and later emitted into the chat page. When an editor, operator, or chat visitor opens that interface, the injected script runs in their browser under the n8n origin. From there the attacker can steal session material, perform actions as the victim against the n8n API, or reach integrations the victim can access. No named threat actors or campaigns are documented for this issue; abuse would most likely be opportunistic via untrusted workflow import rather than in-the-wild mass exploitation.

How to fix it

Upgrade the n8n npm package to a fixed release: 1.123.27 or later on the 1.x line, 2.13.3 or later on 2.13.x, or 2.14.1 or later on 2.14.x and newer. After upgrade, restrict who can create or edit Chat Trigger nodes and who can import workflows from untrusted sources. Until patched, inventory Chat Trigger nodes, treat Custom CSS as untrusted input, disable or strip custom CSS on exposed chat UIs, and avoid publishing chat interfaces that use custom CSS to untrusted viewers. Rotate sessions and connected credentials if a malicious Custom CSS value is found.

How to confirm the fix worked

Confirm the running n8n version is at least 1.123.27 (1.x), 2.13.3 (2.13.x), or 2.14.1 (2.14+). Enumerate workflows that include a Chat Trigger node and inspect Custom CSS for unexpected markup, script-like content, or values not owned by a trusted builder. After upgrading, reload previously suspicious chat UIs and verify that Custom CSS can no longer introduce executable script. Re-test workflow import and Chat Trigger edit paths to confirm only authorized users can change CSS. Review access logs for recent Chat Trigger or workflow-import changes.

Typical attack path

1. Obtain workflow create/edit rights, trick a user into importing an untrusted workflow, or compromise a contributor account
2. Configure or modify a Chat Trigger node and persist attacker-controlled content in the Custom CSS field
3. Activate or share the workflow so the chat interface is reachable by editors, operators, or chat users
4. Wait for a victim to load the chat page in a browser already authenticated to n8n or trusted to that origin
5. Execute script in the victim’s browser and abuse the n8n session or UI
6. Use stolen session context to read credentials, change workflows, or call connected services as the victim

How to detect it

This is stored XSS in saved workflow configuration, so evidence lives in workflow definitions, audit/change history, and browser sessions—not in a distinctive network exploit signature. Export or query workflows that use the Chat Trigger node and inspect Custom CSS for unexpected HTML, script, or URL schemes that do not match approved branding. Review n8n audit or version-history records around Chat Trigger edits and workflow imports, especially from new or external users. On the host or in backups, search persisted workflow JSON for Chat Trigger nodes whose CSS fields changed shortly before suspicious browser activity. In access and reverse-proxy logs, look for unusual requests to chat webhook or chat-page URLs followed by privileged n8n API calls from the same session. Browser or EDR telemetry showing script execution from the n8n origin on chat pages after a workflow import is a strong retrospective signal. No public in-the-wild campaign or ransomware use is documented, so hunting should focus on configuration tampering rather than a known malware family.

• n8n-nodes-base.chatTrigger
• "customCss"
• chatTrigger
• /webhook/chat
• n8n-chat
• javascript:
• </style>
• <script
• -moz-binding
• expression(
• behavior:
• url(data:text/html

What your security team should do

• Patch all n8n npm deployments to 1.123.27+, 2.13.3+, or 2.14.1+ immediately and verify the running version
• Inventory every Chat Trigger node and review Custom CSS and recent workflow imports for untrusted content
• Lock down workflow edit and import permissions; block untrusted workflow JSON until review
• If suspicious Custom CSS is found, invalidate n8n sessions, rotate API keys and connected credentials, and review workflow change history
• Add monitoring for Chat Trigger configuration changes and for workflow imports from outside the organization
• Keep n8n on a supported release line so subsequent chat-UI sanitization fixes are not missed