n8n Stored Cross-Site Scripting Vulnerability in Attachments View Endpoint

A stored cross-site scripting vulnerability has been identified in n8n, a workflow automation platform, prior to version 1.90.0. This issue arises in the attachments view endpoint, where workflows can store and serve binary files to authenticated users. The vulnerability exists because there were no restrictions on the MIME types of uploaded files, allowing an authenticated attacker with member-level permissions to upload a crafted HTML file containing malicious JavaScript. When another user accesses the binary data endpoint with the MIME type set to text/html, the script executes in the context of the user's session, potentially leading to account takeover by changing the user's email address in their account settings.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user’s session.

Remediation

Users can upgrade to n8n version 1.90.0 or later to address this vulnerability.