GHSA-364x-8g5j-x2pr: n8n has XSS in its Credential Management Flow

March 27, 2026

An authenticated user with permission to create and share credentials could craft a malicious OAuth2 credential containing a JavaScript URL in the Authorization URL field. If a victim opened the credential and interacted with the OAuth authorization button, the injected script would execute in their browser session.

References

github.com/advisories/GHSA-364x-8g5j-x2pr
github.com/n8n-io/n8n
github.com/n8n-io/n8n/security/advisories/GHSA-364x-8g5j-x2pr

Code Behaviors & Features

Detect and mitigate GHSA-364x-8g5j-x2pr with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →