@n8n/chat (1.2.0) potentially affected by CVE-2026-25054 via @n8n/design-system (2.2.0)

@n8n/design-system NPM version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @n8n/design-system and may be impacted: - @n8n/chat 1.2.0 Source cves: CVE-2026-25054 Source advisory: SNYK:JS-N8NDESIGNSYSTEM-15225250...

Cross-site Scripting (XSS)

Overview @n8n/design-system is a Affected versions of this package are vulnerable to Cross-site Scripting XSS via the markdown rendering process in the workflow user interface. An attacker can execute arbitrary scripts in the context of another user's session by crafting malicious markdown conten...

@like-a-startup/matildex-chat (>=1.0.8, <=1.0.14), @n8n/chat (>=0.46.0, <=0.68.0) +3 more potentially affected by CVE-2026-25054 via @n8n/design-system (>=1.88.0, <=1.110.0)

@n8n/design-system NPM version =1.88.0, =1.0.8, =0.46.0, =1.0.0, =1.0.4 - navis-n8n-chat-ui 1.0.1 Source cves: CVE-2026-25054 Source advisory: SNYK:JS-N8NDESIGNSYSTEM-15225250...

@n8n/chat (>=1.0.0-rc.0, <=1.1.0) potentially affected by CVE-2026-25054 via @n8n/design-system (>=2.0.0, <=2.1.0)

@n8n/design-system NPM version =2.0.0, =1.0.0-rc.0, =1.1.0 Source cves: CVE-2026-25054 Source advisory: SNYK:JS-N8NDESIGNSYSTEM-15225250...