CVE-2026-65592: n8n before 1.123.64 Stored DOM XSS via cachedResultUrl
Impact The Resource Locator passes the workflow-persisted cachedResultUrl to window.open() without scheme validation. When a victim opens the crafted workflow and interact with external links, the JavaScript payload runs in the victim's browser.
Patches The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict workflow creation and editing permissions to fully trusted users only. - Audit existing workflows for unexpected cachedResultUrl values containing non-HTTP(S) schemes.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Other sources
n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.29.8 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.30.1 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 1.123.64 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.64 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.29.8 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.30.1 - Configuration
Restrict workflow creation and editing permissions to fully trusted users only to reduce the risk of attackers crafting a workflow with a malicious cachedResultUrl (e.g., javascript:) that executes in victims' browsers.
n8n workflow creation/editing permissions restrict to fully trusted users only = fully trusted users only - Compensating control
Audit existing workflows for unexpected cachedResultUrl values containing non-HTTP(S) schemes (e.g., javascript:) and treat any findings as potentially malicious until upgrading.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65592?
CVE-2026-65592 has a severity rating of 8.4, indicating it is a high risk vulnerability.
How do I fix CVE-2026-65592?
To fix CVE-2026-65592, upgrade n8n to version 1.123.64 or later.
What type of vulnerability is CVE-2026-65592?
CVE-2026-65592 is classified as a Stored DOM XSS vulnerability.
What impact does CVE-2026-65592 have on users?
CVE-2026-65592 allows attackers to execute JavaScript payloads in the victim's browser when they open a crafted workflow.
Which software is affected by CVE-2026-65592?
CVE-2026-65592 affects n8n versions prior to 1.123.64.