Is CVE-2026-65592 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65592 being exploited in the wild.

How severe is CVE-2026-65592?

High severity, with a CVSS score of 4, published 22 July 2026.

Which products and versions are affected?

N8n = 2.0.0-rc.0 = 2.30.0 < 2.30.1; n8n (npm) SEMVER:introduced=0,fixed=1.123.64.

Is there a fix for CVE-2026-65592?

Yes. n8n (npm): upgrade to 1.123.64 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-65592 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-65592?

Check whether you run N8n or n8n (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65592: n8n stored DOM XSS in Resource Locator component

Q: Is there a fix for CVE-2026-65592?

Yes. n8n (npm): upgrade to 1.123.64 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-65592 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-65592?

Check whether you run N8n or n8n (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65592 · Severity: high · CVSS 4 · Published 2026-07-22

n8n is a workflow automation tool used to connect different software services. A security vulnerability allows an attacker to create a malicious workflow that, when opened by another user, can execute unauthorized code in their web browser. This could lead to the theft of sensitive session information or unauthorized actions being performed on behalf of the victim.

Technologies: N8n, n8n (npm). Vendors: N8n, npm.

Quick answers

Is CVE-2026-65592 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65592 being exploited in the wild.
How severe is CVE-2026-65592?: High severity, with a CVSS score of 4, published 22 July 2026.
Which products and versions are affected?: N8n < 1.123.64, < 2.29.8, < 2.30.1, < 1.123.64, >= 2.0.0-rc.0 < 2.29.8, >= 2.30.0 < 2.30.1; n8n (npm) SEMVER:introduced=0,fixed=1.123.64.
Is there a fix for CVE-2026-65592?: Yes. n8n (npm): upgrade to 1.123.64 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-65592 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-65592?: Check whether you run N8n or n8n (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

n8n (npm): upgrade to 1.123.64 or later
```
npm install n8n@1.123.64
```

Technical details

A stored DOM-based Cross-Site Scripting (XSS) vulnerability exists in n8n's Resource Locator component. The application fails to validate the URI scheme of the 'cachedResultUrl' parameter before passing it to the 'window.open()' function. An attacker with workflow creation or editing privileges can inject a 'javascript:' payload into this parameter. When a victim opens the crafted workflow and interacts with the associated external links, the payload executes in the context of the victim's browser session. This issue is resolved in versions 1.123.64, 2.29.8, and 2.30.1.

Affected products

n8n-io n8n < 1.123.64, >= 2.0.0-rc.0 < 2.29.8, >= 2.30.0 < 2.30.1

Identifiers

CVE-2026-65592
GHSA-9wcp-9r3j-383q

Timeline

2026-07-08: disclosed: Initial report to n8n-io/n8n
2026-07-22: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.