Every CVE Search/ Get API key

CVE-2026-65592

n8n before 1.123.64 Stored DOM XSS via cachedResultUrl

8.4 HighFix available

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Active

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.24%Down 0.2 points since Jul 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.4

n8n before 1.123.64 Stored DOM XSS via cachedResultUrl

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.

Record
CVE-2026-65592
CVSS 4.0
8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-47636 8.4

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.

Record
EUVD-2026-47636
CVSS 4.0
8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-9wcp-9r3j-383q 8.4

n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`

Impact

The Resource Locator passes the workflow-persisted cachedResultUrl to window.open() without scheme validation. When a victim opens the crafted workflow and interact with external links, the JavaScript payload runs in the victim's browser.

Patches

The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

  • Restrict workflow creation and editing permissions to fully trusted users only.
  • Audit existing workflows for unexpected cachedResultUrl values containing non-HTTP(S) schemes.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Record
GHSA-9wcp-9r3j-383q
CVSS 4.0
8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
GitHub AdvisoriesGHSA-h5xr-fqvj-253p 8.4

Duplicate Advisory: Stored DOM XSS via Resource Locator `cachedResultUrl`

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-9wcp-9r3j-383q. This link is maintained to preserve external references.

Original Description

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.

Record
GHSA-h5xr-fqvj-253p
CVSS 4.0
8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-79
Updated
2026-11-02
NVD 8.4

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.

Record
CVE-2026-65592
CVSS 4.0
8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 8.4

n8n before 1.123.64 Stored DOM XSS via cachedResultUrl

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.

Record
CVE-2026-65592
CVSS 4.0
8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-9wcp-9r3j-383q 8.4

n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`

Impact

The Resource Locator passes the workflow-persisted cachedResultUrl to window.open() without scheme validation. When a victim opens the crafted workflow and interact with external links, the JavaScript payload runs in the victim's browser.

Patches

The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

  • Restrict workflow creation and editing permissions to fully trusted users only.
  • Audit existing workflows for unexpected cachedResultUrl values containing non-HTTP(S) schemes.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Record
GHSA-9wcp-9r3j-383q
CVSS 4.0
8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-h5xr-fqvj-253p 8.4

Duplicate Advisory: Stored DOM XSS via Resource Locator `cachedResultUrl`

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-9wcp-9r3j-383q. This link is maintained to preserve external references.

Original Description

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.

Record
GHSA-h5xr-fqvj-253p
CVSS 4.0
8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-79
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-65592 No score

CVE-2026-65592 in n8n - Patched by Root

Root has patched CVE-2026-65592 in the n8n package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-65592
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
n8n
npm
 before 1.123.64
1.123.64
n8n
npm
 2.30.0 up to 2.30.1
2.30.1
n8n
npm
 2.0.0-rc.0 up to 2.29.8
2.29.8
n8n
Root:npm
 before 2.19.3-aikido.11
2.19.3-aikido.112.19.3-aikido.122.19.3-aikido.132.19.3-aikido.142.19.3-aikido.15
@rootio/n8n
Root:npm
 before 2.19.3-root.io.11
2.19.3-root.io.112.19.3-root.io.122.19.3-root.io.132.19.3-root.io.142.19.3-root.io.15

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-65592 is a high vulnerability (CVSS 8.4) in N8n, published July 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in n8n 1.123.64.

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open