{"data":{"id":"6f3a27bc-8803-4d0d-b79e-fc33dac73962","title":"CVE-2025-58177: n8n is an open source workflow automation platform. From 1.24.0 to before 1.107.0, there is a stored cross-site…","summary":"A stored cross-site scripting flaw affects the chatTrigger node in @n8n/n8n-nodes-langchain, part of the n8n workflow automation platform, in versions from 1.24.0 to before 1.107.0. An authorized user can place malicious JavaScript in the initialMessages field and enable public access, so the script runs in the browser of anyone who opens the public chat URL. The attacker can use this for phishing or to steal cookies and other sensitive data.","solution":"Fixed in 1.107.0. Updating to 1.107.0 or later is recommended. As a workaround, the affected chatTrigger node can be disabled; no other workarounds are known.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-58177","publishedAt":"2025-09-15T21:15:35.783Z","cveId":"CVE-2025-58177","cweIds":["CWE-79"],"cvssScore":"5.4","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["n8n@>= 1.24.0, < 1.107.0 (fixed: 1.107.0)"],"affectedPackageNames":["n8n"],"affectedPackageRefs":["npm:n8n"],"affectedVendors":[],"affectedVendorsRaw":["n8n","LangChain Chat Trigger node"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"n8n stored cross-site scripting in LangChain Chat Trigger initialMessages","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00243,"epssCheckedAt":"2026-11-04T06:10:15.975Z","kevDateAdded":null,"advisoryAliases":["GHSA-mvh4-2cm2-6hpg"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:44.438Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-08-11T12:34:20.999Z","daysToFix":-35,"fixCheckedAt":"2026-10-29T21:43:45.830Z","capecIds":["CAPEC-198","CAPEC-86"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"n8n","fixedVersion":"1.107.0","matchedVersion":"1.107.0","fixReleasedAt":"2025-08-11T12:34:20.999Z","daysToFix":-35,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:43:45.676Z"}]}}