CVE-2026-110847: n8n: stored XSS via Chat Trigger customCss

UNKNOWN

Published October 14, 2026

CISO Take

n8n's Chat Trigger hosted-chat page does not properly sanitise the customCss value, so a workflow author can publish an unauthenticated chat page that runs attacker-controlled JavaScript on the n8n instance origin. That script can act with the session of any signed-in n8n user who opens the page, which could expose the credentials, workflows and API keys the platform holds for connected AI agents and LLM providers. No CVSS score, EPSS data, KEV listing, public exploit or Nuclei template exists yet, so exploitation likelihood is unquantified. Exploitation needs a user with workflow-authoring rights and a victim who visits the page, which makes this mainly an insider or compromised-account risk and a privilege-escalation path. Upgrade to n8n 1.123.83, 2.41.4 or 2.42.1 or later, and review existing Chat Trigger workflows for suspicious customCss values.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

Risk is medium to high pending an official CVSS score. Exploitation is low-complexity once the attacker can create or edit a workflow with a public Chat Trigger. It needs a victim to open the chat link while signed in to n8n, and the impact is session hijacking on the instance origin, with no public exploit or KEV listing so far. Exposure is highest on self-hosted or cloud n8n instances shared by several authors and used for AI agent orchestration, where a low-privileged author could escalate to admin-level actions. Confidence: MEDIUM, since it rests on the vendor advisory and a VulnCheck summary without scoring data.

How does the attack unfold?

Initial Access

Attacker with workflow-authoring rights publishes a public Chat Trigger whose customCss contains a script-injection payload.

AML.T0049

Delivery

Attacker lures a signed-in n8n user to open the hosted chat page link.

AML.T0011.003

Exploitation

The unsanitised CSS is rendered as markup and the script executes on the n8n instance origin with the victim's session.

AML.T0091.000

Impact

Attacker steals credentials and API keys, changes workflows, and abuses connected AI agents and services.

AML.T0048

Initial Access

Attacker with workflow-authoring rights publishes a public Chat Trigger whose customCss contains a script-injection payload.

AML.T0049

Delivery

Attacker lures a signed-in n8n user to open the hosted chat page link.

AML.T0011.003

Exploitation

The unsanitised CSS is rendered as markup and the script executes on the n8n instance origin with the victim's session.

AML.T0091.000

Impact

Attacker steals credentials and API keys, changes workflows, and abuses connected AI agents and services.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade to n8n 1.123.83 or later on the 1.x line, 2.41.4 or later on 2.41.x, or 2.42.1 or later on 2.42.x. 2) Until patched, restrict workflow creation and editing rights to trusted users and disable or unpublish Chat Trigger workflows that are not needed. 3) Audit existing Chat Trigger nodes for customCss values containing HTML, script tags, event handlers or closing style tags. 4) Serve the chat UI from a separate origin from the editor, or apply a restrictive Content-Security-Policy that blocks inline scripts. 5) Rotate credentials and API keys if suspicious CSS content is found, and review n8n audit logs for unexpected workflow changes.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionAuth BypassData LeakageAgentFrameworkPluginAML.T0049- Exploit Public-Facing Application AML.T0091.000- Application Access Token AML.T0093- Prompt Infiltration via Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-110847?

Is CVE-2026-110847 actively exploited?

No confirmed active exploitation of CVE-2026-110847 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110847?

1) Upgrade to n8n 1.123.83 or later on the 1.x line, 2.41.4 or later on 2.41.x, or 2.42.1 or later on 2.42.x. 2) Until patched, restrict workflow creation and editing rights to trusted users and disable or unpublish Chat Trigger workflows that are not needed. 3) Audit existing Chat Trigger nodes for customCss values containing HTML, script tags, event handlers or closing style tags. 4) Serve the chat UI from a separate origin from the editor, or apply a restrictive Content-Security-Policy that blocks inline scripts. 5) Rotate credentials and API keys if suspicious CSS content is found, and review n8n audit logs for unexpected workflow changes.

What systems are affected by CVE-2026-110847?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, LLM orchestration pipelines, chatbot front-ends.

What is the CVSS score for CVE-2026-110847?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation platformsLLM orchestration pipelineschatbot front-ends

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0091.000Application Access Token

AML.T0093Prompt Infiltration via Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, where insufficiently sanitised customCss values are interpolated into the page as markup. Workflow authors can publish a chat without n8n user authentication whose payload executes on the instance origin, acting on the sessions of signed-in visitors.

Exploitation Scenario

An attacker with a low-privileged n8n author account, or a stolen one, creates a workflow with a public Chat Trigger and puts a payload in customCss that breaks out of the style context and injects a script. They send the chat link to an n8n administrator, for example as a request to test a new internal assistant. When the administrator opens it while signed in, the script runs on the n8n origin and uses their session to create an API key, export stored credentials for LLM providers and connected systems, or add a backdoor workflow. The attacker then uses those credentials to reach the organisation's AI services and data.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Primary CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.