{"id":"CVE-2025-56265","aliases":["EUVD-2025-27160","GHSA-v2x8-97xq-8xrr"],"status":"published","title":"N8N's Chat Trigger component is vulnerable to XSS","description":"An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00636,"percentile":0.51013,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-434","CWE-79"],"published":"2025-09-08T00:00:00Z","modified":"2026-11-07T18:10:00Z","fixes":[{"ecosystem":"npm","package":"@n8n/n8n-nodes-langchain","fixed_in":["1.107.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@n8n/n8n-nodes-langchain","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.107.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@n8n/n8n-nodes-langchain","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.107.0"}]}]}],"products":[{"vendor":"n8n","product":"n8n"}],"references":[{"url":"https://github.com/nikolas-ch/CVEs/tree/main/N8N/N8N_v1.100.1","tags":["Exploit","web"]},{"url":"https://github.com/nikolas-ch/CVEs/tree/main/N8N/N8N_v1.100.1/ChatTrigger_StoredXSSviaUnrestrictedFileUpload","tags":["Exploit","web"]},{"url":"https://github.com/nikolas-ch/CVEs/blob/main/N8N/N8N_v1.100.1/ChatTrigger_StoredXSSviaUnrestrictedFileUpload/StoredXSSviaUnristrictedFileUpload.txt","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-56265","tags":["advisory"]},{"url":"https://github.com/n8n-io/n8n/pull/18148","tags":["web"]},{"url":"https://github.com/n8n-io/n8n/releases/tag/n8n%401.107.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v2x8-97xq-8xrr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/56xxx/CVE-2025-56265.json","tags":["advisory"]},{"url":"https://github.com/n8n-io/n8n","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-56265","description":"An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.","status":"published","published":"2025-09-08T00:00:00Z","modified":"2025-09-08T18:35:33.956Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:32:26.64278Z"}],"euvd":[{"id":"EUVD-2025-27160","description":"An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.","status":"published","published":"2025-09-08T00:00:00Z","modified":"2025-09-08T18:35:33Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:31:46.000077Z"}],"ghsa":[{"id":"GHSA-v2x8-97xq-8xrr","title":"N8N's Chat Trigger component is vulnerable to XSS","description":"An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.","status":"published","published":"2025-09-08T18:31:42Z","modified":"2025-09-10T14:51:01Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-79","CWE-434"],"updated_at":"2026-11-02T14:38:57.074217Z"}],"nvd":[{"id":"CVE-2025-56265","description":"An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.","status":"published","published":"2025-09-08T18:15:33.72Z","modified":"2026-11-07T18:10:00.2Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-07T20:06:28.095135Z"}],"osv":[{"id":"CVE-2025-56265","description":"An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.","status":"published","published":"2025-09-08T00:00:00Z","modified":"2026-11-09T02:30:59.840818431Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-09T03:16:44.651171Z"},{"id":"GHSA-v2x8-97xq-8xrr","title":"N8N's Chat Trigger component is vulnerable to XSS","description":"An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file.","status":"published","published":"2025-09-08T18:31:42Z","modified":"2025-09-10T15:12:18.993927Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434","CWE-79"],"updated_at":"2026-11-02T15:46:56.639206Z"}]}}