CVE-2026-65597: n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe
Impact
The HTML preview renders execution output into an iframe srcdoc without sandbox, so a sanitizer bypass lets injected script run same-origin as the editor. When a victim opens the preview, it can call authenticated APIs with their session. An account with global:member privileges can exploit it.
Patches
The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Set the N8NCONTENTSECURITYPOLICY environment variable to a policy that blocks inline scripts. - Avoid exposing workflows that render externally-controlled input into the HTML node or binary HTML preview to untrusted users.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Other sources
n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim's session. An account with global:member privileges can exploit the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.29.8 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.30.1 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 1.123.64 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.64 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.29.8 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.30.1 - Configuration
Set the N8N_CONTENT_SECURITY_POLICY environment variable to a Content Security Policy that blocks inline scripts to mitigate DOM-based XSS via the HTML preview.
n8n N8N_CONTENT_SECURITY_POLICY = a policy that blocks inline scripts - Compensating control
Restrict n8n instance access to fully trusted users only, since an account with global:member privileges can exploit the issue.
- Compensating control
Avoid exposing workflows that render externally-controlled input into the HTML node or binary HTML preview to untrusted users.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65597?
CVE-2026-65597 has a severity rating of high, with a CVSS score of 8.2.
How do I fix CVE-2026-65597?
To fix CVE-2026-65597, upgrade n8n to version 1.123.64 or higher, where this vulnerability has been addressed.
What does CVE-2026-65597 exploit?
CVE-2026-65597 exploits a DOM-Based XSS vulnerability by using an unsandboxed iframe in n8n.
What are the potential impacts of CVE-2026-65597?
The potential impacts include unauthorized execution of scripts that can call authenticated APIs with the user's session.
Who is affected by CVE-2026-65597?
Users with n8n versions before 1.123.64, particularly those with global:member privileges, are affected by CVE-2026-65597.