Alex Joseph
Overview
A significant security flaw, identified as a DOM-based Cross-Site Scripting (XSS) vulnerability, has been found in the popular workflow automation tool n8n. This vulnerability affects various versions of n8n, specifically those prior to versions 1.123.64, 2.29.8, and 2.30.1. In simple terms, this means that a malicious script could potentially run inside a user’s web browser if they interact with a specially crafted preview in n8n. This could lead to an attacker gaining access to sensitive information or performing actions on behalf of the victim without their knowledge.
The core of the issue lies in how n8n’s HTML preview handles execution output. It renders content within an iframe without the necessary security sandbox protections. This oversight allows a crafted script to bypass existing security measures and execute with the same permissions as the editor, effectively compromising the user’s session. An attacker with even low-level “global:member” privileges could exploit this to steal authenticated API session tokens from unsuspecting users who open such a preview.
CVE Details
Product: n8n
CVE ID: CVE-2026-65597
Published: July 8, 2026
Severity: High
Status: Analyzed
Affected Products
The following n8n versions are known to be vulnerable:
- n8n versions prior to 1.123.64 (Community and Enterprise editions)
- n8n 2.x versions prior to 2.29.8 (Community and Enterprise editions)
- n8n versions prior to 2.30.1 (Community and Enterprise editions)
Current Status
This vulnerability has been thoroughly analyzed, and the details, including potential impact and solutions, are publicly available. Software updates have been released by n8n to address this critical flaw.
Severity Level
The vulnerability is rated as High Severity, with a CVSS score of 8.2. This high rating reflects the serious potential impact of a successful exploitation. An attacker with low privileges could exploit this flaw over the network with low complexity. The primary concern is the high impact on confidentiality, as an attacker could gain access to a victim’s authenticated session and call APIs, potentially leading to unauthorized data access or manipulation. The integrity of data could also be compromised, although to a lesser extent.
Possible Solutions
To protect your n8n instances from this DOM-based XSS vulnerability, it is crucial to implement the following solutions:
Patching
The most effective solution is to upgrade your n8n installation to a patched version. The issue has been fixed in:
- n8n version 1.123.64 or later
- n8n version 2.29.8 or later
- n8n version 2.30.1 or later
Users should prioritize upgrading to one of these versions or any subsequent releases to fully remediate the vulnerability.
Temporary Mitigations (if immediate upgrade is not possible)
If you cannot upgrade immediately, consider these temporary steps to reduce risk. Please note, these do not fully eliminate the threat and should only be used as short-term measures:
- Restrict access to your n8n instance to only fully trusted users.
- Set the
N8N_CONTENT_SECURITY_POLICYenvironment variable to a policy that specifically blocks inline scripts. This helps prevent injected scripts from executing. - Avoid exposing workflows that render untrusted external input into the HTML node or binary HTML preview to users who are not fully trusted.
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-p3rg-hrf9-w9gj
- https://www.vulncheck.com/advisories/n8n-before-dom-based-xss-via-unsandboxed-iframe
