N8N's Chat Trigger component is vulnerable to XSS

높음 8.8CVE-2025-56265 · GHSA-v2x8-97xq-8xrr · Published 08/09/2025 · updated 17/06/2026

요약

CVE-2025-56265은(는) n8n (n8n), @n8n/n8n-nodes-langchain에 영향을 주는 높음 (CVSS 8.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.61%, 전체 취약점의 49.3%보다 높음.
조치: 1.107.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
n8n n8n	`= 1.100.1= 1.101.1= 1.95.3`	No fix yet
@n8n/n8n-nodes-langchain npm	`< 1.107.0`	`1.107.0`

Description

An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.

NVD description

An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.

References

nvd.nist.gov/vuln/detail/CVE-2025-56265 · ADVISORY
n8n-io/n8n#18148 · WEB
n8n-io/n8n · PACKAGE
n8n-io/n8n release [email protected] · WEB
nikolas-ch/CVEs · WEB
nikolas-ch/CVEs · Exploit
nikolas-ch/CVEs · Exploit

n8n의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

n8n

= 1.100.1= 1.101.1= 1.95.3

No fix yet

@n8n/n8n-nodes-langchain

npm

< 1.107.0

1.107.0

Description

An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.

NVD description

An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.

n8n의 다른 취약점

모두 보기 →