Stored DOM Cross-Site Scripting Vulnerability in n8n by n8n-io

CVE-2026-65592

What is CVE-2026-65592?

n8n versions prior to 1.123.64, 2.29.8, and 2.30.1 are susceptible to a stored DOM cross-site scripting (XSS) vulnerability. This flaw resides in the Resource Locator component, where the cachedResultUrl parameter from workflows is passed to window.open() without proper scheme validation. An attacker capable of creating or editing workflows can embed a malicious payload (e.g., using the javascript: scheme) in the cachedResultUrl. When a user opens a compromised workflow and interacts with external links, the malicious script executes in the context of the user’s browser, potentially leading to data theft and unauthorized actions.

References