CVE-2026-54301: n8n: Same-Origin XSS in Respond to Webhook Node

June 16, 2026 (updated July 20, 2026)

An authenticated user with workflow edit access could configure a Respond to Webhook node to serve binary content with an attacker-controlled Content-Type. The binary response path bypassed the central Content-Security-Policy sandbox header, allowing a public webhook to execute JavaScript in the n8n origin when visited by an authenticated user, with access to that user’s session.

References

github.com/advisories/GHSA-v733-mwr6-fgcm
github.com/n8n-io/n8n/security/advisories/GHSA-v733-mwr6-fgcm
nvd.nist.gov/vuln/detail/CVE-2026-54301

Code Behaviors & Features

Detect and mitigate CVE-2026-54301 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →