N8n, a popular open-source workflow automation tool, has a significant security flaw that could allow malicious code to run in users’ browsers. This vulnerability, identified as CVE-2026-65592, is a type of stored DOM Cross-Site Scripting (XSS) that affects how n8n handles certain external links within its workflows.<\/p>\n
In simple terms, an attacker with the ability to create or edit workflows can embed harmful JavaScript code into a workflow’s “Resource Locator” component. This is possible because the software doesn’t properly check the safety of the links (specifically the The stored DOM XSS vulnerability impacts various versions of n8n. Specifically, any n8n installation, including both the Community and Enterprise editions (Node.js versions), are vulnerable if they are older than the following patched releases:<\/p>\n If your n8n instance falls into any of these categories, it is exposed to this security risk.<\/p>\n This vulnerability has been “Analyzed,” meaning its details have been thoroughly investigated and understood by security researchers and the vendor. The information regarding its nature, impact, and potential solutions is available to the public.<\/p>\n Rated as ‘Medium’ severity with a CVSS score of 5.4, this vulnerability is a cause for concern but not typically considered critical. A medium rating indicates that while an attack is possible and could lead to significant impact (like compromising user sessions), it usually requires specific conditions, such as the attacker having initial access to workflow creation\/editing privileges and the victim actively interacting with a crafted link. It’s a reminder that even ‘medium’ vulnerabilities should be addressed promptly to maintain a robust security posture.<\/p>\n The good news is that fixes are available for this stored DOM XSS vulnerability. Users are strongly advised to take immediate action to secure their n8n installations.<\/p>\n The n8n development team has released patches to address this issue. To remediate the vulnerability, you should upgrade your n8n instance to one of the following versions or newer:<\/p>\n Upgrading to a patched version is the most effective way to eliminate this risk.<\/p>\n If an immediate upgrade is not feasible, consider implementing these temporary mitigation steps:<\/p>\n These workarounds can help reduce immediate risk but do not provide complete protection. They should only be used as a short-term measure until a full upgrade can be performed.<\/p>\n https:\/\/github.com\/n8n-io\/n8n\/security\/advisories\/GHSA-9wcp-9r3j-383q<\/p>\n https:\/\/www.vulncheck.com\/advisories\/n8n-before-stored-dom-xss-via-cachedresulturl<\/p>\n","protected":false},"excerpt":{"rendered":" N8n, a popular open-source workflow automation tool, has a significant security flaw that could allow malicious code to run in users’ browsers. This vulnerability, identified as CVE-2026-65592, is<\/p>\n","protected":false},"author":17,"featured_media":3515,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[817,1067,695,1068,759],"class_list":["post-4404","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-cross-site-scripting","tag-n8n","tag-web-security","tag-workflow-automation","tag-xss-vulnerability"],"yoast_head":"\ncachedResultUrl<\/code> parameter) before opening them. When another user then opens this compromised workflow and clicks on external links within it, the hidden malicious code can execute in their web browser. This could lead to unauthorized access to sensitive information, session hijacking, or other undesirable actions.<\/p>\nCVE Details<\/h2>\n
\n
Affected Products<\/h2>\n
\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
Patches:<\/h3>\n
\n
Workarounds:<\/h3>\n
\n
cachedResultUrl<\/code> parameter contains unusual or non-standard schemes (e.g., javascript:<\/code> instead of http:\/\/<\/code> or https:\/\/<\/code>). Any such findings should be investigated and removed.<\/li>\n<\/ul>\nReferences<\/h2>\n