GHSA-v2x8-97xq-8xrr

N8N's Chat Trigger component is vulnerable to XSS

Source: GitHub Advisory Database (reviewed) High CVE-2025-56265

Packages

Ecosystem	Package	Affected	Fixed in
npm	@n8n/n8n-nodes-langchain	< 1.107.0	1.107.0

Details

As written in the advisory (Markdown source, shown as plain text).

An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-56265 advisory
https://github.com/n8n-io/n8n/pull/18148 web
https://github.com/n8n-io/n8n package
https://github.com/n8n-io/n8n/releases/tag/n8n%401.107.0 web
https://github.com/nikolas-ch/CVEs/blob/main/N8N/N8N_v1.100.1/ChatTrigger_StoredXSSviaUnrestrictedFileUpload/StoredXSSviaUnristrictedFileUpl… web