Description
n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim-s session. An account with global:member privileges can exploit the issue.
CVSS 5.4EPSS 0.214%Risk 0.55
View source- Published
- 2026-07-22 12:18:19
- Affected versions
- <1.123.64, <2.29.8, <2.30.1
- Type
- Web application
- Last modified
- 2026-07-27 19:15:45
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N