CVE-2026-65597
MEDIUMn8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe
Title source: cnaDescription
n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim's session. An account with global:member privileges can exploit the issue.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-p3rg-hrf9-w9gj)
https://github.com/n8n-io/n8n/security/advisories/GHSA-p3rg-hrf9-w9gj
Third Party Advisory third-party-advisory
VulnCheck Advisory: n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe
https://www.vulncheck.com/advisories/n8n-before-dom-based-xss-via-unsandboxed-iframe
Scores
CVSS v3
5.4
EPSS
0.0021
EPSS Percentile
11.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (11)
n8n/n8n
2.30.0 (2 CPE variants)
n8n/n8n
< 1.123.64 (2 CPE variants)
n8n-io/n8n
< 1.123.64
n8n-io/n8n
< 2.29.8
n8n-io/n8n
< 2.30.1
n8n-io/n8n
1.123.64
n8n-io/n8n
2.29.8
n8n-io/n8n
2.30.1
npm/n8n
0 - 1.123.64npm
npm/n8n
2.0.0-rc.0 - 2.29.8npm
... and 1 more
Published
Jul 22, 2026
Tracked Since
Jul 22, 2026