CVE-2026-65597

Analyzed Analyzed - Analysis Complete

DOM-based XSS in n8n Workflow Automation Platform

Publication date: 2026-07-22

Last updated on: 2026-07-27

Assigner: VulnCheck

Description

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim's session. An account with global:member privileges can exploit the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-65597

EUVD

EUVD-2026-47641

Affected Vendors & Products

Vendor	Product	Version / Range
n8n	n8n	to 1.123.64 (exc)
n8n	n8n	From 2.0.0 (inc) to 2.29.8 (exc)
n8n	n8n	to 1.123.64 (exc)
n8n	n8n	From 2.0.0 (inc) to 2.29.8 (exc)
n8n	n8n	2.30.0
n8n	n8n	2.30.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a DOM-based cross-site scripting (XSS) vulnerability in n8n, an open-source workflow automation tool. It affects versions before 1.123.64, 2.x before 2.29.8, and before 2.30.1. The issue occurs in the HTML preview feature where execution output is rendered into an iframe srcdoc without the sandbox attribute. This allows an attacker to bypass sanitization and inject malicious scripts that execute with the same origin as the editor.

Detection Guidance

Check n8n version against affected releases (before 1.123.64, 2.x before 2.29.8, or before 2.30.1). Inspect HTML preview feature for unsandboxed iframes in srcdoc attributes. Monitor network traffic for unexpected API calls from user sessions during preview rendering.

Impact Analysis

An attacker with global:member privileges can exploit this vulnerability. When a victim opens the HTML preview, the injected script can call authenticated APIs using the victim's session. This may lead to unauthorized actions, data theft, or further compromise of the system.

Compliance Impact

This DOM-based XSS vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. An attacker could exploit it to steal session tokens or sensitive data processed by n8n workflows, resulting in unauthorized data exposure or modification.

Mitigation Strategies

Upgrade n8n to patched versions (1.123.64+ or 2.29.8+ or 2.30.1+). Restrict instance access to trusted users only. Implement Content Security Policy to block inline scripts. Avoid exposing workflows that render untrusted input in HTML previews.

Hi! I’m here to help you understand CVE-2026-65597. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70