Is CVE-2026-118648 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-118648?

CVE-2026-118648 has a CVSS v3 severity of HIGH (7.3).

Back

CVE-2026-118648

Description

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy. Authenticated members who can create and activate workflows can serve HTML that runs on the n8n origin, letting scripts act with the session of users who open the webhook URL.