CVE-2026-65592

Analyzed Analyzed - Analysis Complete

Stored XSS in n8n Workflow Editor via CachedResultUrl Parameter

Publication date: 2026-07-22

Last updated on: 2026-07-27

Assigner: VulnCheck

Description

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-65592

EUVD

EUVD-2026-47636

Affected Vendors & Products

Vendor	Product	Version / Range
n8n	n8n	to 1.123.64 (exc)
n8n	n8n	From 2.0.0 (inc) to 2.29.8 (exc)
n8n	n8n	to 1.123.64 (exc)
n8n	n8n	From 2.0.0 (inc) to 2.29.8 (exc)
n8n	n8n	2.30.0
n8n	n8n	2.30.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored DOM-based cross-site scripting (XSS) vulnerability in n8n, an open-source workflow automation tool. It occurs because the Resource Locator component passes the cachedResultUrl parameter to window.open() without validating the URL scheme. An attacker with workflow creation or editing privileges can embed a malicious scheme like 'javascript:' in cachedResultUrl. When a victim opens the crafted workflow and interacts with external links, the payload executes in their browser.

Detection Guidance

Check n8n versions for those below 1.123.64, 2.29.8, or 2.30.1. Inspect workflows for cachedResultUrl parameters containing non-HTTP(S) schemes like javascript:. Audit user permissions for workflow creation/editing to ensure only trusted users have access.

Impact Analysis

The vulnerability allows attackers to execute arbitrary JavaScript in a victim's browser when they open a crafted workflow. This could lead to theft of session cookies, account takeover, or unauthorized actions on behalf of the victim. Exploitation requires low privileges and user interaction but has high impacts on confidentiality and integrity.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA due to its impact on confidentiality and integrity. The stored DOM-based XSS allows attackers to execute malicious scripts in a victim's browser, which may lead to unauthorized data access, modification, or exfiltration. GDPR requires protecting personal data integrity and confidentiality, while HIPAA mandates safeguarding protected health information. Exploitation of this flaw could result in unauthorized data breaches, compromising compliance with these regulations.

Mitigation Strategies

Upgrade n8n to versions 1.123.64, 2.29.8, or 2.30.1 or later. Restrict workflow creation and editing permissions to trusted users only. Temporarily remove or review workflows with suspicious cachedResultUrl values until patched.

Hi! I’m here to help you understand CVE-2026-65592. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70