CVE-2026-65597: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in n8n-io n8n
n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim's session. An account with global:member privileges can exploit the issue.
AI Analysis
Technical Summary
CVE-2026-65597 is a DOM-based cross-site scripting vulnerability in n8n's HTML preview functionality. The vulnerability exists because the preview renders execution output into an iframe srcdoc without applying the sandbox attribute, and the sanitizer used can be bypassed. This allows injected scripts to execute with the same origin as the editor, enabling them to perform actions on behalf of the victim by calling authenticated APIs using the victim's session. Exploitation requires an attacker to have an account with global:member privileges and to trick a victim into opening the malicious preview. The affected versions are n8n before 1.123.64, all 2.x versions before 2.29.8, and versions after 2.29.8 but before 2.30.1.
Potential Impact
Successful exploitation allows an attacker with global:member privileges to execute arbitrary scripts in the context of the editor, leading to unauthorized API calls using the victim's authenticated session. This can result in unauthorized actions within the n8n environment, potentially compromising workflows and data accessible via the authenticated APIs.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, restrict account privileges to limit global:member access and avoid opening untrusted HTML previews.
CVE-2026-65597: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in n8n-io n8n
Description
n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim's session. An account with global:member privileges can exploit the issue.
CVSS v4.0
Score 8.2high
Affected software
pkg:npm/n8n-io/n8nRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-65597 is a DOM-based cross-site scripting vulnerability in n8n's HTML preview functionality. The vulnerability exists because the preview renders execution output into an iframe srcdoc without applying the sandbox attribute, and the sanitizer used can be bypassed. This allows injected scripts to execute with the same origin as the editor, enabling them to perform actions on behalf of the victim by calling authenticated APIs using the victim's session. Exploitation requires an attacker to have an account with global:member privileges and to trick a victim into opening the malicious preview. The affected versions are n8n before 1.123.64, all 2.x versions before 2.29.8, and versions after 2.29.8 but before 2.30.1.
Potential Impact
Successful exploitation allows an attacker with global:member privileges to execute arbitrary scripts in the context of the editor, leading to unauthorized API calls using the victim's authenticated session. This can result in unauthorized actions within the n8n environment, potentially compromising workflows and data accessible via the authenticated APIs.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, restrict account privileges to limit global:member access and avoid opening untrusted HTML previews.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-22T10:45:44.833Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a60ab939c2644c7f8eced49
Added to database: 07/22/2026, 11:37:55 UTC
Last enriched: 07/22/2026, 11:52:14 UTC
Last updated: 07/23/2026, 02:51:54 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.