CVE-2026-65597: n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview
The HTML preview renders execution output into an iframe srcdoc without sandbox, so a sanitizer bypass lets injected script run same-origin as the editor. When a victim opens the preview, it can call authenticated APIs with their session. An account with global:member privileges can exploit it.
References
- github.com/advisories/GHSA-p3rg-hrf9-w9gj
- github.com/n8n-io/n8n/releases/tag/n8n@1.123.64
- github.com/n8n-io/n8n/releases/tag/n8n@2.29.8
- github.com/n8n-io/n8n/releases/tag/n8n@2.30.1
- github.com/n8n-io/n8n/security/advisories/GHSA-p3rg-hrf9-w9gj
- nvd.nist.gov/vuln/detail/CVE-2026-65597
- www.vulncheck.com/advisories/n8n-before-dom-based-xss-via-unsandboxed-iframe
Code Behaviors & Features
Detect and mitigate CVE-2026-65597 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →