CVE-2025-52478
1 advisory.
npm/n8n CVE-2025-52478: high 8.7, EPSS 0.39%
Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source
Action: Upgrade n8n to 1.98.2 or later.
npm i n8n@1.98.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.77.0 | 1.98.2 | - |
Fixed versions
| 1.98.2 |
Sources
- osv: GHSA-hfmv-hhh3-43f2
- https://github.com/n8n-io/n8n/security/advisories/GHSA-hfmv-hhh3-43f2
- https://nvd.nist.gov/vuln/detail/CVE-2025-52478
- https://github.com/n8n-io/n8n/pull/16329
- https://github.com/n8n-io/n8n/commit/7940384a85041a1890b1203d69c092c887312500
- https://github.com/n8n-io/n8n
CVE-2025-52478 · published · modified · JSON