Alex Joseph
N8n, a popular open-source workflow automation tool, has a significant security flaw that could allow malicious code to run in users’ browsers. This vulnerability, identified as CVE-2026-65592, is a type of stored DOM Cross-Site Scripting (XSS) that affects how n8n handles certain external links within its workflows.
In simple terms, an attacker with the ability to create or edit workflows can embed harmful JavaScript code into a workflow’s “Resource Locator” component. This is possible because the software doesn’t properly check the safety of the links (specifically the cachedResultUrl parameter) before opening them. When another user then opens this compromised workflow and clicks on external links within it, the hidden malicious code can execute in their web browser. This could lead to unauthorized access to sensitive information, session hijacking, or other undesirable actions.
CVE Details
- Product: n8n
- CVE ID: CVE-2026-65592
- Published Date: July 22, 2026
- Severity: Medium (CVSS Score 5.4)
- Status: Analyzed
Affected Products
The stored DOM XSS vulnerability impacts various versions of n8n. Specifically, any n8n installation, including both the Community and Enterprise editions (Node.js versions), are vulnerable if they are older than the following patched releases:
- Versions prior to 1.123.64
- Versions prior to 2.29.8
- Versions prior to 2.30.1
If your n8n instance falls into any of these categories, it is exposed to this security risk.
Current Status
This vulnerability has been “Analyzed,” meaning its details have been thoroughly investigated and understood by security researchers and the vendor. The information regarding its nature, impact, and potential solutions is available to the public.
Severity Level
Rated as ‘Medium’ severity with a CVSS score of 5.4, this vulnerability is a cause for concern but not typically considered critical. A medium rating indicates that while an attack is possible and could lead to significant impact (like compromising user sessions), it usually requires specific conditions, such as the attacker having initial access to workflow creation/editing privileges and the victim actively interacting with a crafted link. It’s a reminder that even ‘medium’ vulnerabilities should be addressed promptly to maintain a robust security posture.
Possible Solutions
The good news is that fixes are available for this stored DOM XSS vulnerability. Users are strongly advised to take immediate action to secure their n8n installations.
Patches:
The n8n development team has released patches to address this issue. To remediate the vulnerability, you should upgrade your n8n instance to one of the following versions or newer:
- n8n 1.123.64 or higher
- n8n 2.29.8 or higher
- n8n 2.30.1 or higher
Upgrading to a patched version is the most effective way to eliminate this risk.
Workarounds:
If an immediate upgrade is not feasible, consider implementing these temporary mitigation steps:
- Restrict Workflow Permissions: Limit the ability to create and edit workflows strictly to users who are fully trusted and have a clear understanding of security best practices.
- Audit Existing Workflows: Regularly review your current workflows. Look for any instances where the
cachedResultUrlparameter contains unusual or non-standard schemes (e.g.,javascript:instead ofhttp://orhttps://). Any such findings should be investigated and removed.
These workarounds can help reduce immediate risk but do not provide complete protection. They should only be used as a short-term measure until a full upgrade can be performed.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-9wcp-9r3j-383q
https://www.vulncheck.com/advisories/n8n-before-stored-dom-xss-via-cachedresulturl
