CVE-2026-65592 is a stored DOM XSS vulnerability in n8n's Resource Locator component affecting versions before 1.123.64, 2.29.8, and 2.30.1. The issue occurs because the cachedResultUrl parameter, persisted in workflows, is passed directly to window.open() without scheme validation. An attacker with privileges to create or edit workflows can embed a malicious URL with a javascript: scheme. When a victim opens the crafted workflow and interacts with external links, the malicious script executes in their browser context, leading to potential compromise of user session or data.

Successful exploitation allows an attacker with workflow creation or editing privileges to execute arbitrary JavaScript in the context of a victim's browser when they open the malicious workflow and interact with external links. This can lead to high-impact consequences such as session hijacking, unauthorized actions, or data exposure within the affected application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict workflow creation and editing privileges to trusted users only to reduce the risk of exploitation. Monitor vendor communications for updates regarding patches or official mitigations.