Automation

Make is great at moving data between systems. That convenience is exactly why XSS can sneak in so easily. I’ve seen teams assume XSS is only a frontend bug. Then they wire Make into forms, CRMs, CMS tools, Slack, email builders, internal dashboards, and webhook handlers. Suddenly untrusted input is flowing through ten services, getting reformatted three times, and landing in HTML somewhere nobody reviewed carefully. That’s the real problem with XSS in Make automations: Make usually isn’t the final vulnerable layer, but it can absolutely become the delivery mechanism. ...

n8n is great at moving data between systems fast. That also makes it great at moving attacker-controlled HTML and JavaScript straight into places you did not expect. If you build internal tools, approval flows, chat integrations, or webhook-driven automations with n8n, you are already handling untrusted input. The problem starts when that input gets rendered in a browser, embedded into HTML emails, dropped into dashboard widgets, or passed into a frontend without output encoding. ...