UpHeron
All vulnerabilities

Servers and applications

CVE-2025-52478

n8n is a workflow automation platform. From 1.77.0 to before 1.98.2, a stored Cross-Site Scripting (XSS) vulnerability was identified in n8n, specifically in the Form Trigger node's HTML form element. An authenticated attacker can inject malicious HTML via an <iframe> with a srcdoc payload that includes arbitrary JavaScript execution. The attacker can also inject malicious Javascript by using…

Severity
Medium 5.4
Published
19 Aug 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.98.2
Sources
NVD

Affected software

SoftwareAffected versions
n8nServers and applications · cpe:a:n8n:n8n
  • From 1.77.0 before 1.98.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-52478
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-52478