Vulnerability Report

CVE-2025-58177

Title: N8N Cross-Site Scripting (XSS)

XSS

Proof Of Concept

No public PoC currently indexed for CVE-2025-58177.

CWE Category CWE-79

Published Date Sep 15, 2025

Modified Date Oct 14, 2025

Exploit Status Not Found

Score 5.4 CVSS v3.1

Exploit Probability (EPSS)

0.22%

Vulnerability Summary

CVE-2025-58177: n8n is an open source workflow automation platform. From 1.24.0 to before 1.107.0, there is a stored cross-site scripting (XSS) vulnerability in @n8n/n8n-nodes-langchain.chatTrigger. An authorized user can configure the LangChain Chat Trigger node with malicious JavaScript in the initialMessages field and enable public access so that the payload is executed in the browser of any user who visits the resulting public chat URL. This can be used for phishing or to steal cookies or other sensitive data from users accessing the public chat link. The issue is fixed in version 1.107.0. Updating to 1.107.0 or later is recommended. As a workaround, the affected chatTrigger node can be disabled. No other workarounds are known.

Impacted Vendors

n8n 1

Reference Links

https://github.com/n8n-io/n8n/commit/d4ef191be0b39b65efa68559a3b8d5dad2e102b2 https://github.com/n8n-io/n8n/pull/18148 https://github.com/n8n-io/n8n/security/advisories/GHSA-mvh4-2cm2-6hpg

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

5.4

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2025-58177 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

October 14, 2025 MODIFIED

Vulnerability data or affected products updated.

October 14, 2025 MODIFIED

Vulnerability data updated via NVD.

September 15, 2025 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction REQUIRED

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected Stack

No specific products linked.