Executive brief
n8n, a popular workflow automation tool, is affected by a security flaw in its HTML preview feature. An attacker with basic member access can craft malicious content that, when viewed by another user, executes scripts in that user's session. This could allow the attacker to perform unauthorized actions or access sensitive data by hijacking the victim's authenticated session.
Technical details
A DOM-based cross-site scripting (XSS) vulnerability exists in n8n's HTML preview component. The application renders execution output into an iframe 'srcdoc' attribute without the 'sandbox' attribute, and a sanitizer bypass allows for the execution of arbitrary JavaScript. The injected script executes in the same origin as the editor, enabling it to make authenticated API calls using the victim's active session. Exploitation requires the attacker to have 'global:member' privileges and for a victim to open the malicious preview. The issue is addressed in versions 1.123.64, 2.29.8, and 2.30.1.
Affected products
- n8n-io n8n < 1.123.64, 2.x < 2.29.8, < 2.30.1
Timeline
- 2026-07-22: advisory: Original advisory published and subsequently withdrawn as a duplicate.
- 2026-07-22: disclosed: NVD publication date.