CVE-2026-65597 Details
Description
n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim's session. An account with global:member privileges can exploit the issue.
A DOM-based cross-site scripting vulnerability has been identified in n8n versions prior to 1.123.64, 2.x prior to 2.29.8, and versions prior to 2.30.1. The vulnerability arises in the HTML preview feature, which outputs execution results into an iframe srcdoc without a sandbox attribute. This lack of proper sanitization allows injected scripts to execute in the same origin as the editor. When the preview is opened, the scripts can interact with authenticated APIs using the victim's session. The issue can be exploited by accounts with global:member privileges.
Users are advised to upgrade to n8n versions 1.123.64, 2.29.8, or 2.30.1. If an immediate upgrade is not possible, consider restricting access to trusted users, setting the N8N_CONTENT_SECURITY_POLICY environment variable to block inline scripts, and avoiding exposure of workflows that include externally-controlled input in the HTML node or binary HTML preview to untrusted users.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-p3rg-hrf9-w9gj | [email protected] | MitigationVendor Advisory |
| https://www.vulncheck.com/advisories/n8n-before-dom-based-xss-via-unsandboxed-iframe | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | < 1.123.64 >= 2.0.0, < 2.29.8 2.30.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 22, 2026 | New CVE Received | [email protected] |