Executive brief
n8n is a workflow automation platform used by organizations to build and run automated tasks and integrations. The Resource Locator component in n8n contains a stored cross-site scripting (XSS) vulnerability where malicious JavaScript code can be embedded in workflows and executed in users' browsers when they open crafted workflows and interact with external links. An attacker with workflow creation privileges could steal sensitive data or perform unauthorized actions on behalf of victims.
Technical details
The vulnerability is a stored DOM XSS in the Resource Locator component of n8n, where the cachedResultUrl parameter is passed to window.open() without validation of the URL scheme. An attacker with workflow creation or editing permissions can inject a malicious URL containing a javascript: scheme into the cachedResultUrl field; when a victim opens the crafted workflow and interacts with external links, the JavaScript payload executes in the victim's browser context. The attack requires low-level privileges (workflow creation capability) and user interaction (victim opening the workflow and clicking a link). Fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1.
Affected products
- n8n n8n < 1.123.64, < 2.29.8, < 2.30.1
Timeline
- 2026-07-08: disclosed: Original advisory GHSA-9wcp-9r3j-383q published
- 2026-07-22: advisory: Duplicate advisory GHSA-h5xr-fqvj-253p published then withdrawn