CVE-2026-65592 in n8n
Summary
by MITRE • 07/22/2026
n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability under examination represents a critical stored DOM cross-site scripting flaw within n8n versions prior to 1.123.64, 2.29.8, and 2.30.1, specifically affecting the Resource Locator component functionality. This security weakness resides in how the system handles workflow-persisted cachedResultUrl parameters, creating an avenue for malicious execution when processed through window.open() function without proper scheme validation mechanisms. The flaw directly violates fundamental web security principles by failing to sanitize or validate URL schemes before browser execution contexts are invoked.
The technical implementation of this vulnerability stems from insufficient input validation within the resource locator component where user-supplied data containing cachedResultUrl parameters flows directly into browser execution contexts. When an attacker with workflow creation or editing privileges crafts a malicious workflow containing javascript: scheme URLs within the cachedResultUrl parameter, the system stores this data persistently in the workflow database. Upon subsequent access by legitimate users who interact with external links within the workflow interface, the stored malicious URL executes within the victim's browser context through the window.open() API call that lacks proper validation of the URL scheme.
This vulnerability directly maps to CWE-79 which defines Cross-Site Scripting (XSS) conditions where untrusted data is improperly integrated into web pages served to users. The specific operational impact involves a privilege escalation scenario where attackers leverage workflow editing permissions to inject malicious payloads that execute in the context of victim users with the same browser privileges and session cookies. The ATT&CK framework categorizes this under T1566 - Phishing and T1203 - Exploitation for Client Execution, as it enables attackers to deliver malicious code through legitimate workflow interfaces.
The exploitation timeline begins with an attacker gaining access to n8n workflow creation capabilities, typically through compromised credentials or elevated user permissions. The attacker then constructs a malicious workflow containing a javascript: scheme URL within the cachedResultUrl parameter, which gets stored in the system's persistent workflow database. When victims open this crafted workflow and interact with external links, the browser executes the malicious JavaScript code as part of the window.open() call, potentially allowing attackers to steal session cookies, redirect users to malicious sites, or perform additional client-side attacks.
Mitigation strategies should focus on immediate patching of affected n8n versions to the recommended secure releases that implement proper URL scheme validation. The system must enforce strict validation of URL schemes before processing cachedResultUrl parameters through window.open() calls, rejecting any non-HTTP/HTTPS schemes to prevent execution of dangerous protocols like javascript:, data:, or file:. Additionally, administrators should implement role-based access controls to limit workflow editing privileges and conduct regular security audits of deployed workflows. Network-level protections including web application firewalls and content security policies can provide additional defense-in-depth layers while the core vulnerability is addressed through proper input validation and sanitization mechanisms.