CVE-2026-110849

7.2High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Active
Impact: High impact on confidentiality, integrity
Weakness: CWE-79

Impact

Authenticated members can run malicious JavaScript in the context of any user who previews an uploaded binary file, potentially hijacking instance owner sessions. Attackers need a valid member account to upload the crafted file and trick another user into viewing it.

Root cause

The file-preview modal serves binary data via an unsandboxed same-origin blob URL instead of isolating it.

Affected systems

n8n versions prior to 1.123.83, 2.41.4, and 2.42.1

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade n8n to version 1.123.83, 2.41.4, 2.42.1, or later depending on your release branch. No interim configuration mitigation is specified, so restrict untrusted user access to the instance until patched.

shell

$ npm install -g n8n@latest

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the owner, and act with their session.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110849