What is GHSA-h86q-fx34-gfjr?

GHSA-h86q-fx34-gfjr is a security advisory published by GitHub Security Advisories with Medium severity. n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints

Which CVE IDs does GHSA-h86q-fx34-gfjr cover?

GHSA-h86q-fx34-gfjr covers the following CVE IDs: CVE-2026-54303. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h86q-fx34-gfjr?

GHSA-h86q-fx34-gfjr has a CVSS v3 base score of 7.6, published by GitHub Security Advisories.

Which products are affected by GHSA-h86q-fx34-gfjr?

GHSA-h86q-fx34-gfjr affects 1 product, including: npm/n8n:\u003c 2.24.0.

GHSA-h86q-fx34-gfjrMediumCVSS 7.6

n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints

Vendor

GitHub Security Advisories

Published

June 16, 2026

Last Modified

June 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-54303 →

📋 Description

Impact

An endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers, enabling reflected XSS in the n8n origin when a logged-in user visits a crafted URL.

Patches

The issue has been fixed in n8n version 2.24.0. Users should upgrade to this version or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

Limit workflow creation and activation permissions to fully trusted users only.
Disable the affected nodes by adding n8n-nodes-base.facebookTrigger, n8n-nodes-base.whatsAppTrigger, n8n-nodes-base.facebookLeadAdsTrigger, and n8n-nodes-base.microsoftTeamsTrigger to the NODES_EXCLUDE environment variable.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

🎯 Affected products1

npm/n8n:< 2.24.0