CVE-2025-58177

n8n is an open source workflow automation platform. From 1.24.0 to before 1.107.0, there is a stored cross-site scripting (XSS) vulnerability in @n8n/n8n-nodes-langchain.chatTrigger. An authorized user can configure the LangChain Chat Trigger node with malicious JavaScript in the initialMessages field and enable public access so that the payload is executed in the browser of any user who visits the resulting public chat URL. This can be used for phishing or to steal cookies or other sensitive data from users accessing the public chat link. The issue is fixed in version 1.107.0. Updating to 1.107.0 or later is recommended. As a workaround, the affected chatTrigger node can be disabled. No other workarounds are known.

• CWE-79

• https://github.com/n8n-io/n8n/commit/d4ef191be0b39b65efa68559a3b8d5dad2e102b2Patch
• https://github.com/n8n-io/n8n/pull/18148Issue Tracking
• https://github.com/n8n-io/n8n/security/advisories/GHSA-mvh4-2cm2-6hpgVendor Advisory

Published

Sep 15, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58171Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2025-58172drawnix is an all in one open-source whiteboard tool. In dra…5.3
• CVE-2025-58173FreshRSS is a self-hosted RSS feed aggregator. In versions 1…8.8
• CVE-2025-58174LDAP Account Manager (LAM) is a webfrontend for managing ent…4.6
• CVE-2025-58175GeoServer is an open source server that allows users to shar…8.2
• CVE-2025-58176Dive is an open-source MCP Host Desktop Application that ena…8.8
• CVE-2025-58178SonarQube Server and Cloud is a static analysis solution for…7.8
• CVE-2025-58179Astro is a web framework for content-driven websites. Versio…6.5
• CVE-2025-5818The Featured Image Plus – Quick & Bulk Edit with Unsplash pl…5.5
• CVE-2025-58180OctoPrint provides a web interface for controlling consumer …8.8
• CVE-2025-58181SSH servers parsing GSSAPI authentication requests do not va…5.3
• CVE-2025-58182Rejected reason: reserved but not needed