CVE-2026-65597: CVE-2026-65597: DOM-based Cross-Site Scripting (XSS) in n8n HTML Preview

#security #cve #cybersecurity

CVE-2026-65597: DOM-based Cross-Site Scripting (XSS) in n8n HTML Preview

Vulnerability ID: CVE-2026-65597
CVSS Score: 8.2
Published: 2026-07-22

A critical DOM-based Cross-Site Scripting (XSS) vulnerability exists in n8n's workflow editor HTML preview component. By failing to include a sandbox attribute on the iframe used to display node execution output, n8n allowed rendered execution outputs to run arbitrary JavaScript within the same-origin context of the editor parent window. This vulnerability can be exploited by an attacker with low-privileged ('global:member') access to hijack an authenticated administrator's session and perform unauthorized API actions.

TL;DR

Unsandboxed iframe and sanitizer bypass in n8n's HTML preview allow low-privileged users to execute arbitrary JavaScript in the victim's session context, leading to session hijacking.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-79
Attack Vector: Network (AV:N)
CVSS Score: 8.2 (High)
Privileges Required: Low (PR:L)
User Interaction: Required (UI:A)
Exploit Status: Proof-of-Concept / Conceptual
CISA KEV Status: Not Listed

Affected Systems

n8n workflow automation platform
n8n: < 1.123.64 (Fixed in: 1.123.64)
n8n: 2.x < 2.29.8 (Fixed in: 2.29.8)
n8n: < 2.30.1 (Fixed in: 2.30.1)

Mitigation Strategies

Upgrade n8n to patched versions
Restrict global:member privileges to trusted users
Avoid viewing untrusted execution output HTML previews

Remediation Steps:

Identify current n8n deployment version
Download and deploy the fixed version (1.123.64, 2.29.8, or 2.30.1+)
Verify iframe elements in the editor now utilize the 'sandbox' attribute

References

Read the full report for CVE-2026-65597 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community