Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

CVE-2026-65597

medium

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution…

Vendor / product: N8n — n8n

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim's session. An account with global:member privileges can exploit the issue.

CVSS
5.4
5.4 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-07-22 12:18
Modified: 2026-10-29 20:17
NVD status: Analyzed
Last synced 10 hours ago
Verified against the source API 2026-10-29 20:26 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

n8n / n8n <1.123.64, ≥2.0.0 <2.29.8, 2.30.0

Weakness classification (CWE)

CWE-79

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-p3rg-hrf9-w9gj
Patch / mitigation: https://github.com/n8n-io/n8n/security/advisories/GHSA-p3rg-hrf9-w9gj

References

Data sources

NVD CVE API 2.0 — fetched 2026-10-29 20:26 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2026-85173CVE-2026-85172CVE-2026-85171CVE-2026-85170CVE-2026-85169