CVE-2026-65597: DOM-based Cross-Site Scripting (XSS) in n8n HTML Preview

n8n is an extensible workflow automation platform that allows users to build complex integrations and data processing pipelines. A key feature of the n8n workflow editor is the ability to view the execution output of specific nodes in an HTML format directly within the user interface. This feature is intended to display rich representations of HTTP responses, parsed data, or custom code outputs.\n\nThe HTML preview functionality is implemented on the frontend to present content to the user in a styled layout. To prevent the rendered output's styling and structure from interfering with the parent application's layout, n8n developers embedded the output within an HTML iframe element. This design choice, however, introduced a significant security boundary that was not properly restricted.\n\nBecause the iframe is populated dynamically using the 'srcdoc' attribute, it inherits the origin of the parent page. Without proper sandboxing or strict execution controls, any active content within the iframe runs in the same origin as the n8n editor, creating an avenue for DOM-based Cross-Site Scripting (XSS).

The underlying vulnerability stems from the omission of the 'sandbox' attribute on the iframe container used to render the preview. In modern web browsers, iframes loaded via the 'srcdoc' attribute inherit the origin of their parent document unless they are explicitly restricted. This default browser behavior means that the iframe and the parent editor window share the same execution origin, enabling full DOM access across the boundary.\n\nWhile n8n attempted to neutralize malicious content by running user-supplied HTML through a client-side sanitizer, this defense proved insufficient. Client-side sanitizers are notoriously susceptible to parser-differential and mutation-based XSS (mXSS) bypasses. When a sanitizer fails to recognize a specific nested or malformed HTML construct, the browser's parser reconstructs the document into an active executable format during DOM insertion.\n\nOnce a payload successfully bypasses the sanitizer filter, it is written into the iframe's 'srcdoc' attribute. Because the iframe runs under the same-origin policy as the n8n interface, the script can seamlessly access the 'window.parent' object, bypassing any attempt to isolate the preview environment.

Analyzing the DOM structure reveals how the vulnerability manifests in the browser. In vulnerable versions of n8n, the preview panel renders the HTML content using a standard iframe tag without restriction:\n\nhtml\n<!-- Vulnerable Implementation -->\n<iframe srcdoc=\"<div>User-controlled content here</div>\"></iframe>\n\n\nTo remediate this, the iframe must be explicitly sandboxed to restrict script execution, form submission, and origin sharing. The patch introduces the 'sandbox' attribute to ensure that the iframe content is treated as having a unique, opaque origin, preventing it from interacting with the parent window:\n\nhtml\n<!-- Patched Implementation -->\n<iframe sandbox=\"allow-popups\" srcdoc=\"<div>User-controlled content here</div>\"></iframe>\n\n\nThe following diagram illustrates the interaction between the parent editor and the unsandboxed iframe:\n\nmermaid\ngraph LR\n Parent[\"n8n Editor Parent Window\"] -->|Injects output into srcdoc| Iframe[\"Unsandboxed Iframe\"]\n Iframe -->|Bypasses sanitizer| Script[\"Malicious Script Execution\"]\n Script -->|window.parent Access| Parent\n Parent -->|Steals session data| Attacker[\"Attacker Server\"]\n

To exploit this vulnerability, an attacker must first obtain 'global:member' privileges within the n8n application. This level of access allows the attacker to create or modify workflows, specifically configuring a node (such as an HTTP Request or Code node) that generates a custom execution output containing a crafted payload.\n\nOnce the malicious workflow is configured, the attacker triggers an execution or waits for a victim with administrative privileges to view the workflow run. When the victim opens the HTML preview panel for the affected node, the frontend retrieves the execution output, sanitizes it using the vulnerable client-side routine, and inserts it into the iframe.\n\nIf the payload leverages a parser-differential bypass, it executes within the iframe. Because the iframe is same-origin, the script accesses 'window.parent.localStorage' or cookies to retrieve the active session token. It then utilizes the 'fetch' API or 'navigator.sendBeacon' to transmit the credentials to an attacker-controlled listener, completing the session hijacking process.

The security consequences of CVE-2026-65597 are critical due to the privileged context in which n8n editors operate. Since n8n is an automation platform, the web interface typically has access to integrated database credentials, API keys, and third-party authentication tokens stored within the workspace.\n\nA successful session hijacking attack allows the adversary to impersonate the victim administrator entirely. The attacker can read sensitive workflow definitions, extract API credentials from the system configuration, or modify active workflows to execute arbitrary commands on the hosting server.\n\nThis vulnerability has been assigned a CVSS v4.0 score of 8.2 (High). The high impact on confidentiality and integrity, combined with the lack of system-level restrictions on same-origin iframe execution, makes it a severe vector for privilege escalation within the n8n ecosystem.

The primary remediation for CVE-2026-65597 is updating the n8n installation to a secure release. The vendors have backported the fix to multiple release branches to ensure coverage for various deployment environments.\n\n> [!IMPORTANT]\n> Users on the 1.x branch must upgrade to version 1.123.64 or higher. Users on the 2.x branch must upgrade to version 2.29.8 or 2.30.1 depending on their current release track.\n\nIf immediate patching is not feasible, organizations should restrict member-level access ('global:member') to trusted personnel only. Additionally, administrators should avoid inspecting HTML previews of executions derived from untrusted external sources, such as public webhooks or unverified HTTP responses, until the software is updated.