https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T13:05:51.260572+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-54301 CVE-2026-54301 — n8n: Same-Origin XSS in Respond to Webhook Node 2026-10-06T13:05:51.529033+00:00

Affected: n8n-io n8n

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authenticated user with workflow edit access could configure a Respond to Webhook node to serve binary content with an attacker-controlled Content-Type. The binary response path bypassed the central Content-Security-Policy sandbox header, allowing a public webhook to execute JavaScript in the n8n origin when visited by an authenticated user, with access to that user's session. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.