CVE-2026-65597: DOM-based Cross-Site Scripting (XSS) in n8n HTML Preview

Vulnerability ID: CVE-2026-65597
CVSS Score: 8.2
Published: 2026-07-22

A critical DOM-based Cross-Site Scripting (XSS) vulnerability exists in n8n's workflow editor HTML preview component. By failing to include a sandbox attribute on the iframe used to display node execution output, n8n allowed rendered execution outputs to run arbitrary JavaScript within the same-origin context of the editor parent window. This vulnerability can be exploited by an attacker with low-privileged ('global:member') access to hijack an authenticated administrator's session and perform unauthorized API actions.

TL;DR

Unsandboxed iframe and sanitizer bypass in n8n's HTML preview allow low-privileged users to execute arbitrary JavaScript in the victim's session context, leading to session hijacking.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-79
• Attack Vector: Network (AV:N)
• CVSS Score: 8.2 (High)
• Privileges Required: Low (PR:L)
• User Interaction: Required (UI:A)
• Exploit Status: Proof-of-Concept / Conceptual
• CISA KEV Status: Not Listed

Affected Systems

• n8n workflow automation platform
• n8n: < 1.123.64 (Fixed in: 1.123.64)
• n8n: 2.x < 2.29.8 (Fixed in: 2.29.8)
• n8n: < 2.30.1 (Fixed in: 2.30.1)

Mitigation Strategies

• Upgrade n8n to patched versions
• Restrict global:member privileges to trusted users
• Avoid viewing untrusted execution output HTML previews

Remediation Steps:

1. Identify current n8n deployment version
2. Download and deploy the fixed version (1.123.64, 2.29.8, or 2.30.1+)
3. Verify iframe elements in the editor now utilize the 'sandbox' attribute

References

• n8n Security Advisory (GHSA-p3rg-hrf9-w9gj)
• VulnCheck Security Bulletin
• n8n Release v1.123.64 Patch
• n8n Release v2.29.8 Patch
• n8n Release v2.30.1 Patch

Read the full report for CVE-2026-65597 on our website for more details including interactive diagrams and full exploit analysis.