Skip to content
← Vulnerability catalog
OFFICIAL CVE RECORD8.2 High

CVE-2026-65597

n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim's session. An account with global:member privileges can exploit the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n8n-io n8n

Default version status: unaffected

  • 0 to < 1.123.64affected
  • 1.123.64unaffected
pkg:npm/n8n

n8n-io n8n

Default version status: unaffected

  • 2.30.0 to < 2.30.1affected
  • 2.30.1unaffected
pkg:npm/n8n

n8n-io n8n

Default version status: unaffected

  • 2.0.0-rc.0 to < 2.29.8affected
  • 2.29.8unaffected
pkg:npm/n8n

References