CVE-2026-65592: Stored DOM-based Cross-Site Scripting via cachedResultUrl in n8n

Vulnerability ID: CVE-2026-65592
CVSS Score: 8.4
Published: 2026-07-22

A Stored DOM-based Cross-Site Scripting (XSS) vulnerability exists within the frontend Resource Locator component of n8n. The flaw stems from insecure usage of window.open() where the application evaluates the workflow-persisted parameter 'cachedResultUrl' without verifying its protocol scheme. Authenticated attackers with permissions to create or edit workflows can insert a 'javascript:' URI payload, leading to arbitrary code execution in the victim's browser context upon interaction.

TL;DR

Stored DOM-based XSS in n8n's Resource Locator component allows low-privilege users to execute arbitrary JavaScript in administrative sessions by crafting malicious workflows.

Technical Details

• CWE ID: CWE-79
• Attack Vector: Network (AV:N)
• CVSS v4.0: 8.4
• Exploit Status: None
• KEV Status: Not Listed

Affected Systems

• n8n Workflow Automation Platform
• n8n: < 1.123.64 (Fixed in: 1.123.64)
• n8n: >= 2.0.0-rc.0 < 2.29.8 (Fixed in: 2.29.8)
• n8n: 2.30.0 (specifically < 2.30.1) (Fixed in: 2.30.1)

Mitigation Strategies

• Upgrade n8n immediately to safe releases to introduce URL protocol validation
• Restrict user creation and workflow modification permissions to trusted personnel
• Inspect database records for anomalous parameter prefixes

Remediation Steps:

1. Determine the active n8n installation version
2. Identify the corresponding patched version (1.123.64, 2.29.8, or 2.30.1)
3. Apply the patch using the appropriate package manager or pulling the updated container image
4. Verify the update is active by checking the frontend application version
5. Scan existing database entries for workflows containing the 'javascript:' URI scheme

References

• n8n Security Advisory GHSA-9wcp-9r3j-383q
• NVD - CVE-2026-65592 Detail

Read the full report for CVE-2026-65592 on our website for more details including interactive diagrams and full exploit analysis.