GHSA-w673-8fjw-457c

What it actually does

An authenticated n8n user can abuse the Form Node so that form pages served by n8n execute attacker-controlled script in the application origin and/or send the browser to an unvalidated external URL after form interaction. The renderer does not adequately sanitize Form Node content (labels, descriptions, or similar fields) and does not sufficiently constrain post-submit redirect destinations, enabling stored or reflected XSS and open redirect from a trusted n8n host. Impact is limited to clients that load or submit the malicious form; server-side workflow execution and connected systems are not directly compromised by the flaw itself.

Why it matters to the business

Operators who visit a poisoned form can lose n8n session cookies or tokens, and respondents can be phished from a URL that looks like a legitimate internal automation. That can lead to account takeover of workflow editors and, indirectly, abuse of integrations those accounts can reach. The issue is medium-low severity (CVSS 4.1), requires a valid n8n login, is not listed in CISA KEV, has no reported ransomware use, and has no known public exploit code more than 200 days after disclosure. Residual risk is mainly social engineering and session theft on unpatched Form Node workflows, not unauthenticated remote takeover.

How an attack unfolds

An attacker who already has n8n credentials creates or edits a workflow that includes a Form Node and places unsanitized markup or an attacker-chosen redirect destination into form-controlled fields. They activate the workflow so n8n serves the form at a normal form URL, then share that link with a colleague or form respondent. When the victim opens or submits the form, the browser either runs the injected script in the n8n origin (allowing theft of session material or UI spoofing) or follows the open redirect to an attacker site for phishing. No named threat actors, KEV campaigns, or mature public exploits are associated with this issue; abuse would look like ordinary authenticated workflow editing plus a social lure to the form.

How to fix it

Upgrade n8n (npm) to a fixed release on your line: 1.123.24 or later on 1.x, 2.10.4 or later on the 2.10 line, or 2.12.0 or later (including current 2.x). After upgrade, inventory workflows that use Form / Form Trigger nodes, remove unexpected external redirect targets, and restrict who can create or edit form workflows. Treat remaining unpatched instances as needing the same upgrade; there is no complete configuration-only fix for the sanitization and redirect validation defects.

How to confirm the fix worked

Confirm the running n8n package version is at least 1.123.24, 2.10.4, or 2.12.0 as appropriate. In the editor, open Form Node workflows and verify field labels, help text, and redirect settings contain only expected plain content and first-party destinations. After patching, have a trusted user load existing forms and confirm that previously dangerous field content is escaped (shown as text, not executed) and that redirects no longer leave the intended host. Do not attempt to re-introduce attack strings on production; use a staging instance and version check plus workflow review as the primary proof of fix.

Typical attack path

1. Obtain a valid n8n account (stolen, shared, or low-privilege credentials).
2. Create or modify a workflow that uses a Form Node.
3. Place unsanitized content in form-rendered fields and/or set an untrusted post-submit redirect destination.
4. Activate or publish the workflow so the form is reachable on the n8n instance.
5. Send the form URL to an authenticated n8n user or form respondent.
6. Victim loads or submits the form, executing script in the n8n origin or following the redirect.
7. Attacker harvests session tokens or credentials and may reuse the stolen n8n session to access other workflows.

How to detect it

There are no public exploit kits or named actor TTPs for this issue, so hunting is for suspicious authenticated use of forms rather than a unique malware signature. Review n8n application and reverse-proxy logs for requests to form-serving paths around workflow publish times; correlate with audit or editor events that create or update Form Node workflows. Inspect stored workflow JSON for Form Node redirect destinations that leave your n8n host and for HTML or script-like content in form field labels and descriptions. On the client side, look for unexpected cross-origin navigations immediately after form submit and for session use from new locations after a user visited a form. Absence of these artifacts does not prove non-exploitation, because a one-time XSS payload may leave little on disk.

• n8n-nodes-base.formTrigger
• n8n-nodes-base.form
• /form-waiting/
• /form/
• redirectUrl
• javascript:
• data:text/html

What your security team should do

• Patch all n8n (npm) deployments to 1.123.24+, 2.10.4+, or 2.12.0+ immediately; the fix is version-based.
• Inventory and review Form Node / Form Trigger workflows for unexpected redirect URLs and untrusted field content.
• Limit Form Node create/edit rights to a small set of trusted operators and disable unused public form endpoints.
• Rotate sessions for users who may have opened untrusted forms on unpatched instances.
• Monitor form URL access and workflow-update audit events for anomalous authenticated activity; no in-the-wild campaign is known, but the issue has been public for many months.