CVE-2026-65597CWE-79

n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe

High · published July 22, 2026

CVSS v4.0
8.2
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim's session. An account with global:member privileges can exploit the issue.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
EPSS
0.00296 · 21.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-22T11:21Z
EPSS history
Timeline
  • 22 JUL 11:21Z
    n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe
    cvelistv5