js · n8nCritical
n8n: Respond to Webhook Node Allows Content-Type Injection Bypassing CSP
An authenticated user with workflow edit access can configure a Respond to Webhook node to serve binary content with an attacker-controlled Content-Type, bypass
What changed
An authenticated user with workflow edit access can configure a Respond to Webhook node to serve binary content with an attacker-controlled Content-Type, bypassing the CSP sandbox header and allowing JavaScript execution in the n8n origin.
Who it affects
All n8n instances where authenticated users have workflow edit access, especially those using public webhooks.
What to do today
Upgrade to n8n version 1.123.55, 2.25.7, or 2.26.2 immediately. If upgrade is not possible, limit workflow creation/editing permissions and disable the Respond to Webhook node via NODES_EXCLUDE.
The trail
Collected→
Audited→
Written→
Published
Source
GitHub Advisory · n8n