CVE-2026-65592
CVE-2026-65592 · n8n before 1.123.64 Stored DOM XSS via cachedResultUrl
This page contains facts from public vulnerability sources. Check the original advisory before updating.
n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.
CVSS 8.4 · High · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
n8n
- Versions
- ≥ 0, < 1.123.64: Affected (semver)
- 1.123.64: Not affected (semver)
Update to 1.123.64
n8n
- Versions
- ≥ 0, < 2.30.1: Affected (semver)
- 2.30.1: Not affected (semver)
Update to 2.30.1
n8n
- Versions
- ≥ 0, < 2.29.8: Affected (semver)
- 2.29.8: Not affected (semver)
Update to 2.29.8
n8n npm
- Affected ranges
- SEMVER: < 1.123.64
Update to 1.123.64
n8n npm
- Affected ranges
- SEMVER: ≥ 2.30.0, < 2.30.1
Update to 2.30.1
n8n npm
- Affected ranges
- SEMVER: ≥ 2.0.0-rc.0, < 2.29.8
Update to 2.29.8