n8n Stored XSS (Attachments)

A Stored XSS vulnerability in n8n's file attachment endpoint that can lead to indirect RCE and session hijacking.

## Vulnerability Overview
n8n handles file attachments in various workflow nodes (Email, HTTP Request, etc.). This vulnerability exists because uploaded files with HTML/SVG content types are served without proper Content-Type headers or Content-Security-Policy, allowing JavaScript execution when the file is viewed in the browser.

## Technical Details
- **Type:** Stored XSS via File Upload (CWE-79)
- **Root Cause:** When files are uploaded through workflow executions, they are stored and served by n8n's file endpoint. HTML and SVG files are served with their original Content-Type, allowing embedded JavaScript to execute in the origin context of the n8n application.
- **Attack Vector:** Upload a malicious SVG/HTML file through a workflow input → file is stored → when viewed, JavaScript executes

## Exploitation Chain
1. Upload malicious SVG file containing JavaScript
2. Admin views the file attachment in the execution log
3. JavaScript executes in the admin's session context
4. Steal session token → access all workflows → modify Code node → achieve RCE

## Impact
- Session hijacking and account takeover
- Indirect RCE through workflow modification
- Access to all credentials and workflow data