N8n (>= 2.30.0, < 2.30.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/n8n--2.30.0--2.30.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 22 Jul 2026 18:02:15 +0000n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`https://feed.craftedsignal.io/briefs/2026-07-n8n-stored-dom-xss/Wed, 22 Jul 2026 18:02:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-n8n-stored-dom-xss/A stored DOM XSS vulnerability in n8n's Resource Locator feature allows attackers to inject malicious JavaScript into the cachedResultUrl parameter. When a victim opens a specially crafted workflow and interacts with external links, the JavaScript payload executes in their browser, due to a lack of scheme validation for `cachedResultUrl` passed to `window.open()`.A high-severity stored DOM XSS vulnerability, identified as CVE-2026-65592, exists in the n8n workflow automation platform's Resource Locator feature. This flaw affects versions prior to 1.123.64, versions 2.0.0-rc.0 through 2.29.7, and version 2.30.0. Attackers can exploit this by injecting malicious JavaScript into the cachedResultUrl parameter within a crafted workflow. The vulnerability stems from a lack of scheme validation when cachedResultUrl is passed to window.open(). When a victim opens such a workflow and interacts with external links, the injected JavaScript executes in their browser. This allows for potential session hijacking, data exfiltration, or further client-side compromise, making it critical for defenders to prioritize upgrading to patched versions.

Attack Chain

  1. An attacker gains authenticated access to an n8n instance with privileges to create or edit workflows.
  2. The attacker crafts a malicious JavaScript payload and embeds it within the cachedResultUrl parameter of an n8n workflow.
  3. The attacker saves the specially crafted workflow onto the vulnerable n8n instance.
  4. A victim user opens the compromised workflow in their browser, loading the malicious cachedResultUrl value into the DOM.
  5. The victim interacts with an external link within the workflow, triggering the window.open() function that uses the unvalidated cachedResultUrl.
  6. The embedded JavaScript payload executes within the victim's browser context, bypassing same-origin policies.
  7. The attacker's script performs actions such as session hijacking, data exfiltration, or further client-side exploitation.

Impact

Successful exploitation of CVE-2026-65592 allows an attacker to execute arbitrary JavaScript within a victim's browser context. This can lead to various severe consequences, including session hijacking, unauthorized access to the victim's n8n account, data exfiltration of sensitive information displayed in the n8n interface, or further client-side exploitation through drive-by downloads or credential harvesting. While no specific victim numbers are provided, any user interacting with a compromised workflow could be affected, posing a significant risk to organizations using vulnerable n8n instances. The primary impact is on the confidentiality and integrity of user data within the affected n8n instance.

Recommendation

Immediately patch n8n instances to versions 1.123.64, 2.29.8, 2.30.1, or later to address CVE-2026-65592. As a temporary mitigation, restrict workflow creation and editing permissions in n8n to only trusted users. Implement application-level auditing to identify workflows containing unexpected cachedResultUrl values with non-HTTP(S) schemes, as detailed in the workarounds section of the advisory for CVE-2026-65592.

]]>highadvisoryxssvulnerabilityn8n