Skip to content
Threat Feed
Subscribe

Product

N8n (1.x)

1 brief RSS
high advisory

N8n DOM-based XSS via Unsandboxed iframe srcdoc in HTML Preview

A high-severity DOM-based cross-site scripting (XSS) vulnerability exists in n8n versions prior to 1.123.64, 2.29.8, and 2.30.1, allowing an attacker with global:member privileges to inject malicious JavaScript into an unsandboxed HTML preview, enabling same-origin execution and unauthorized API calls using a victim's session upon preview access.

n8n +1 cross-site-scripting xss web-application ghsa
2t