CVE-2026-65592: Stored DOM-based Cross-Site Scripting via cachedResultUrl in n8n
Vulnerability ID: CVE-2026-65592
CVSS Score: 8.4
Published: 2026-07-22
A Stored DOM-based Cross-Site Scripting (XSS) vulnerability exists within the frontend Resource Locator component of n8n. The flaw stems from insecure usage of window.open() where the application evaluates the workflow-persisted parameter 'cachedResultUrl' without verifying its protocol scheme. Authenticated attackers with permissions to create or edit workflows can insert a 'javascript:' URI payload, leading to arbitrary code execution in the victim's browser context upon interaction.
TL;DR
Stored DOM-based XSS in n8n's Resource Locator component allows low-privilege users to execute arbitrary JavaScript in administrative sessions by crafting malicious workflows.
Technical Details
- CWE ID: CWE-79
- Attack Vector: Network (AV:N)
- CVSS v4.0: 8.4
- Exploit Status: None
- KEV Status: Not Listed
Affected Systems
- n8n Workflow Automation Platform
-
n8n: < 1.123.64 (Fixed in:
1.123.64) -
n8n: >= 2.0.0-rc.0 < 2.29.8 (Fixed in:
2.29.8) -
n8n: 2.30.0 (specifically < 2.30.1) (Fixed in:
2.30.1)
Mitigation Strategies
- Upgrade n8n immediately to safe releases to introduce URL protocol validation
- Restrict user creation and workflow modification permissions to trusted personnel
- Inspect database records for anomalous parameter prefixes
Remediation Steps:
- Determine the active n8n installation version
- Identify the corresponding patched version (1.123.64, 2.29.8, or 2.30.1)
- Apply the patch using the appropriate package manager or pulling the updated container image
- Verify the update is active by checking the frontend application version
- Scan existing database entries for workflows containing the 'javascript:' URI scheme
References
Read the full report for CVE-2026-65592 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (1)
The vulnerability in n8n's Resource Locator component, specifically the insecure usage of
window.open()with thecachedResultUrlparameter, highlights the importance of validating URL protocol schemes to prevent Stored DOM-based Cross-Site Scripting attacks. I've seen similar issues in other applications where user-inputted URLs are not properly sanitized, leading to potential security risks. The remediation steps provided, such as upgrading to a patched version and scanning existing database entries for malicious workflows, are crucial in mitigating this vulnerability. It's also worth noting that implementing Content Security Policy (CSP) could help detect and prevent such XSS attacks, do you think incorporating CSP in n8n could be a valuable additional security measure?