Vulnerability Details CVE-2026-54303
n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers, enabling reflected XSS in the n8n origin when a logged-in user visits a crafted URL. This vulnerability is fixed in 2.24.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 21.5%
CVSS Severity
CVSS v3 Score 5.4