CVE-2026-65592: n8n stored XSS via javascript: URI

Q: Is CVE-2026-65592 actively exploited?

No confirmed active exploitation of CVE-2026-65592 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-65592?

Patch to n8n 1.123.64, 2.29.8, or 2.30.1 as soon as possible. Until patched, restrict workflow creation/editing permissions to trusted, vetted personnel and avoid importing or opening workflows shared by external or lower-trust parties. Enforce httpOnly/SameSite session cookies and short session lifetimes to limit the value of any token theft. Add monitoring/audit logging for Resource Locator fields (cachedResultUrl) containing non-http(s) schemes such as javascript:, data:, or vbscript: as a detection signal, and review recently imported or shared workflows for suspicious link values.

Q: What systems are affected by CVE-2026-65592?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration.

Q: What is the CVSS score for CVE-2026-65592?

No CVSS score has been assigned yet.

CISO Take

A stored DOM cross-site scripting flaw in n8n's Resource Locator component lets anyone with workflow creation or editing rights embed a javascript: URI in the workflow-persisted cachedResultUrl field, which n8n later passes unvalidated to window.open() when a victim clicks the resource link. n8n sits at the center of many AI agent and automation pipelines — with 16 tracked downstream dependents and 150 other CVEs already logged against this package (OpenSSF Scorecard 6.6/10, package risk score 69/100), it is a high-value target for lateral movement inside automation infrastructure. There is no CISA KEV listing, no EPSS score, no public exploit code, and no Nuclei template, so this is not being actively exploited today, but the bug requires nothing more than basic JavaScript knowledge and a legitimate low-privilege editor account to weaponize against a higher-privilege teammate who opens the crafted workflow. Patch to n8n 1.123.64, 2.29.8, or 2.30.1 immediately; until then, restrict workflow creation/editing to trusted, vetted users and treat any workflow imported from outside your organization as untrusted before opening or interacting with its resource links.

Sources: NVD GitHub Advisory CISA KEV OpenSSF ATLAS vulncheck.com

What is the risk?

Overall risk is moderate rather than critical: exploitation requires an attacker to already hold workflow creation/editing privileges and requires the victim to actively interact with a crafted external link, which limits the blast radius to insider-threat and compromised-low-privilege-account scenarios rather than unauthenticated remote attack. No CVSS score, EPSS data, KEV listing, or public exploit/scanner coverage exists yet, so real-world exploitation likelihood currently appears low. However, the impact ceiling is high in collaborative n8n deployments where editors and admins share workflows: a malicious or compromised low-privilege user could use this to escalate against higher-privilege operators who manage credentials and production automations.

How does the attack unfold?

Initial Access

An attacker holding workflow creation/editing privileges crafts a workflow embedding a javascript: URI in a Resource Locator node's cachedResultUrl field.

AML.T0081

Delivery

The malicious workflow is shared within a team workspace or imported as a template, positioning it for a higher-privileged victim to open.

AML.T0011.003

Execution

The victim opens the workflow and clicks the resource link icon; window.open() evaluates the javascript: scheme, executing attacker JavaScript in the victim's authenticated n8n session.

AML.T0011

Impact

The injected script steals session tokens or credentials and can modify workflows or exfiltrate connected AI/automation data using the victim's privileges.

Initial Access

An attacker holding workflow creation/editing privileges crafts a workflow embedding a javascript: URI in a Resource Locator node's cachedResultUrl field.

AML.T0081

Delivery

The malicious workflow is shared within a team workspace or imported as a template, positioning it for a higher-privileged victim to open.

AML.T0011.003

Execution

The victim opens the workflow and clicks the resource link icon; window.open() evaluates the javascript: scheme, executing attacker JavaScript in the victim's authenticated n8n session.

AML.T0011

Impact

The injected script steals session tokens or credentials and can modify workflows or exfiltrate connected AI/automation data using the victim's privileges.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.123.64	`1.123.64`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

Patch to n8n 1.123.64, 2.29.8, or 2.30.1 as soon as possible. Until patched, restrict workflow creation/editing permissions to trusted, vetted personnel and avoid importing or opening workflows shared by external or lower-trust parties. Enforce httpOnly/SameSite session cookies and short session lifetimes to limit the value of any token theft. Add monitoring/audit logging for Resource Locator fields (cachedResultUrl) containing non-http(s) schemes such as javascript:, data:, or vbscript: as a detection signal, and review recently imported or shared workflows for suspicious link values.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Social Engineering Agent Plugin AML.T0011 - User Execution AML.T0011.003 - Malicious Link AML.T0012 - Valid Accounts AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MANAGE-4.1 - Mechanisms are in place to monitor AI system incidents and document responses

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-65592?

A stored DOM cross-site scripting flaw in n8n's Resource Locator component lets anyone with workflow creation or editing rights embed a javascript: URI in the workflow-persisted cachedResultUrl field, which n8n later passes unvalidated to window.open() when a victim clicks the resource link. n8n sits at the center of many AI agent and automation pipelines — with 16 tracked downstream dependents and 150 other CVEs already logged against this package (OpenSSF Scorecard 6.6/10, package risk score 69/100), it is a high-value target for lateral movement inside automation infrastructure. There is no CISA KEV listing, no EPSS score, no public exploit code, and no Nuclei template, so this is not being actively exploited today, but the bug requires nothing more than basic JavaScript knowledge and a legitimate low-privilege editor account to weaponize against a higher-privilege teammate who opens the crafted workflow. Patch to n8n 1.123.64, 2.29.8, or 2.30.1 immediately; until then, restrict workflow creation/editing to trusted, vetted users and treat any workflow imported from outside your organization as untrusted before opening or interacting with its resource links.

Is CVE-2026-65592 actively exploited?

No confirmed active exploitation of CVE-2026-65592 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-65592?

Patch to n8n 1.123.64, 2.29.8, or 2.30.1 as soon as possible. Until patched, restrict workflow creation/editing permissions to trusted, vetted personnel and avoid importing or opening workflows shared by external or lower-trust parties. Enforce httpOnly/SameSite session cookies and short session lifetimes to limit the value of any token theft. Add monitoring/audit logging for Resource Locator fields (cachedResultUrl) containing non-http(s) schemes such as javascript:, data:, or vbscript: as a detection signal, and review recently imported or shared workflows for suspicious link values.

What systems are affected by CVE-2026-65592?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration.

What is the CVSS score for CVE-2026-65592?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestration

MITRE ATLAS Techniques

AML.T0011 User Execution

AML.T0011.003 Malicious Link

AML.T0012 Valid Accounts

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.

Exploitation Scenario

A contractor or compromised low-privilege n8n account with workflow-editing rights creates or modifies a workflow, setting a node's Resource Locator cachedResultUrl to a javascript: payload disguised as a link to an external resource (e.g., a Google Sheets or Airtable reference). The workflow is shared within the team or left in a shared workspace. A higher-privileged admin later opens the workflow to review or run it and clicks the resource link icon to inspect the referenced external resource; window.open() evaluates the javascript: URI in the n8n origin's authenticated context, executing the attacker's script to steal the admin's session cookie or n8n API key, which the attacker then uses to access stored credentials and pivot into connected AI/automation services.

Weaknesses (CWE)

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Primary CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.