GHSA-mvh4-2cm2-6hpg

Suggest an improvement
Source
https://github.com/advisories/GHSA-mvh4-2cm2-6hpg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-mvh4-2cm2-6hpg/GHSA-mvh4-2cm2-6hpg.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-mvh4-2cm2-6hpg
Aliases
Published
2025-09-15T17:14:27Z
Modified
2025-09-15T20:07:54Z
Severity
  • 4.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N CVSS Calculator
Summary
Stored XSS in n8n LangChain Chat Trigger Node via initialMessages Parameter
Details

Impact

A stored Cross-Site Scripting (XSS) vulnerability was identified in the @n8n/n8n-nodes-langchain.chatTrigger node in n8n. If an authorized user configures the node with malicious JavaScript in the initialMessages field and enables public access, the script will be executed in the browser of anyone who visits the resulting public chat URL.

This vulnerability could be exploited for phishing or to steal cookies or other sensitive data from users who access the public chat link, posing a security risk.

Patches

This issue has been patched in version 1.107.0 of n8n. Users should upgrade to version 1.107.0 or later.

Workarounds

Disabling the n8n-nodes-langchain.chatTrigger node (docs)

References

18148

Database specific 
{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed_at": "2025-09-15T17:14:27Z",
    "nvd_published_at": "2025-09-15T17:15:35Z",
    "severity": "MODERATE"
}
References

Affected packages

npm / n8n

Package

Name
n8n
View open source insights on deps.dev
Purl
pkg:npm/n8n

Affected ranges

Type
SEMVER
Events
Introduced
1.24.0
Fixed
1.107.0