CVE-2026-65597: n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

The HTML preview renders execution output inside an iframe using srcdoc. The iframe has no sandbox attribute, so it shares the origin of the n8n editor. The only barrier is the sanitizer. A sanitizer bypass lets injected script run same-origin (CWE-79, DOM-based).

The attacker needs an account with global:member privileges and a way to get content into execution output, for example a workflow that renders externally controlled input in the HTML node or a binary HTML preview. A victim, such as an admin or a workflow owner, must then open that preview. The script runs in the victim's session and can call n8n's authenticated APIs with the victim's rights. The CVSS 4.0 vector rates confidentiality impact as high and integrity as low, with user interaction required.

In practice, a low-privilege member can read data and act as a higher-privilege user on a shared n8n instance. Credentials and workflow data are the likely targets. The advisory gives no proof of concept.

Affected: n8n below 1.123.64 on the 1.x line, 2.0.0-rc.0 up to but not including 2.29.8, and 2.30.0. Instances where untrusted or semi-trusted users hold member accounts, or where workflows render outside input through the HTML node or HTML preview, carry the most risk.

Check the npm install:

npm ls n8n

For Docker, check the version shown in the n8n UI or the image tag.

Upgrade to n8n 1.123.64, 2.29.8 or 2.30.1, or later. For an npm install, run npm install [email protected]. For Docker, pull a patched image tag and recreate the container.

If you cannot upgrade yet, the advisory lists short-term mitigations. They do not fully remove the risk:

• Restrict instance access to fully trusted users.
• Set N8N_CONTENT_SECURITY_POLICY to a policy that blocks inline scripts.
• Do not expose workflows that render externally controlled input into the HTML node or binary HTML preview to untrusted users.

The advisory names no log signature. Review which workflows pass external input into the HTML node or a binary HTML preview. Look for member-created workflows whose output contains script tags or event-handler attributes. Check audit and API logs for unexpected authenticated API calls, such as credential reads or new users and workflows, that follow a preview being opened by an admin or owner.

Impact

The HTML preview renders execution output into an iframe srcdoc without sandbox, so a sanitizer bypass lets injected script run same-origin as the editor. When a victim opens the preview, it can call authenticated APIs with their session. An account with global:member privileges can exploit it.

Patches

The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Set the N8N_CONTENT_SECURITY_POLICY environment variable to a policy that blocks inline scripts.
• Avoid exposing workflows that render externally-controlled input into the HTML node or binary HTML preview to untrusted users.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.