N8n DOM-based XSS via Unsandboxed iframe srcdoc in HTML Preview

A high-severity DOM-based cross-site scripting (XSS) vulnerability (GHSA-vhcw-f978-xjjg) has been identified in the n8n workflow automation platform. Specifically, versions prior to 1.123.64 (for 1.x), 2.29.8, and 2.30.1 (for 2.x) are affected. The vulnerability lies within n8n's HTML preview functionality, which, when rendering execution output, uses an iframe srcdoc without the crucial sandbox attribute. This oversight, combined with a sanitizer bypass, enables attackers holding global:member privileges to inject arbitrary JavaScript code. When a victim subsequently opens this manipulated preview, the injected script executes within the same-origin context as the n8n editor, effectively hijacking the victim's authenticated session and allowing unauthorized calls to n8n's internal APIs. This could lead to data exfiltration, workflow manipulation, or further compromise of the n8n environment. The vulnerability represents a significant risk for organizations using affected n8n instances.

Attack Chain

1. An attacker, possessing an account with global:member privileges in n8n, crafts malicious "execution output" containing JavaScript code designed for XSS exploitation.
2. The attacker introduces this malicious output into the n8n environment, likely as part of a workflow execution result or a similar feature that generates previewable HTML.
3. A victim, typically another n8n user or administrator, accesses or is directed to open the HTML preview associated with the attacker-controlled execution output.
4. The n8n application renders the preview using an iframe srcdoc element that lacks the sandbox attribute, failing to isolate the content from the parent domain.
5. Due to an identified sanitizer bypass, the malicious JavaScript payload contained within the srcdoc is executed directly within the victim's browser, operating with the same-origin context as the n8n editor.
6. The injected script leverages the victim's active authenticated session to invoke n8n's internal authenticated APIs.
7. This allows the attacker to perform actions with the victim's privileges, such as exfiltrating sensitive data, altering existing workflows, creating new malicious workflows, or otherwise manipulating the n8n environment.
8. The final objective is typically data exfiltration, unauthorized modification of configurations, or further lateral movement within the compromised n8n instance.

Impact

Successful exploitation of this XSS vulnerability allows an attacker to execute arbitrary code within the victim's browser session, operating with the same privileges as the victim. This enables the attacker to make unauthorized API calls within the n8n environment, potentially leading to data theft, modification or deletion of sensitive workflows, configuration changes, or escalation of privileges. Organizations using affected n8n instances could face significant operational disruption, data breaches, and compromise of their automation infrastructure, particularly if an administrator's session is hijacked. The specific number of victims and sectors targeted are not detailed in the advisory, but any n8n deployment utilizing the vulnerable versions is at risk.

Recommendation

• Upgrade n8n instances immediately to a patched version (1.123.64, 2.29.8, 2.30.1, or later) to address the vulnerability described in GHSA-vhcw-f978-xjjg.
• Monitor web server access logs for n8n for any unusual requests or patterns that might indicate attempts to introduce or trigger malicious content.