n8n Node.js Package < 1.123.9 / 2.x < 2.2.1 Stored XSS (CVE-2026-25054)

The version of the n8n Node.js Package installed on the remote host is prior to 1.123.9, or 2.x prior to 2.2.1. It is, therefore, affected by a stored cross-site scripting vulnerability: - A cross-site scripting XSS vulnerability existed in a markdown rendering component used in n8n's interface,...

CVE-2026-25054

creationtimestamp| type| source ---|---|--- 2026-02-05 08:08:06+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-n8n-1...

@n8n/chat (1.2.0) potentially affected by CVE-2026-25054 via @n8n/design-system (2.2.0)

@n8n/design-system NPM version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @n8n/design-system and may be impacted: - @n8n/chat 1.2.0 Source cves: CVE-2026-25054 Source advisory: SNYK:JS-N8NDESIGNSYSTEM-15225250...

@like-a-startup/matildex-chat (>=1.0.8, <=1.0.14), @n8n/chat (>=0.46.0, <=0.68.0) +3 more potentially affected by CVE-2026-25054 via @n8n/design-system (>=1.88.0, <=1.110.0)

@n8n/design-system NPM version =1.88.0, =1.0.8, =0.46.0, =1.0.0, =1.0.4 - navis-n8n-chat-ui 1.0.1 Source cves: CVE-2026-25054 Source advisory: SNYK:JS-N8NDESIGNSYSTEM-15225250...

@n8n/chat (>=1.0.0-rc.0, <=1.1.0) potentially affected by CVE-2026-25054 via @n8n/design-system (>=2.0.0, <=2.1.0)

@n8n/design-system NPM version =2.0.0, =1.0.0-rc.0, =1.1.0 Source cves: CVE-2026-25054 Source advisory: SNYK:JS-N8NDESIGNSYSTEM-15225250...