{"id":"EUVD-2026-47636","enisaUuid":"cbb217b6-4927-3103-a179-53abb2694a73","description":"n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim\u0027s browser.","datePublished":"Jul 22, 2026, 11:21:41 AM","dateUpdated":"Oct 29, 2026, 9:16:23 PM","baseScore":8.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-9wcp-9r3j-383q\nhttps://www.vulncheck.com/advisories/n8n-before-stored-dom-xss-via-cachedresulturl\n","aliases":"CVE-2026-65592\nGHSA-h5xr-fqvj-253p\nGHSA-9wcp-9r3j-383q\n","assigner":"VulnCheck","epss":0.24,"enisaIdProduct":[{"id":"5c584727-f1db-3082-acaf-1c2d8fe173ec","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"0 \u003c1.123.64"},{"id":"e59a8d19-be8c-3734-b50a-8526a56f880f","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0-rc.0 \u003c2.29.8"},{"id":"fe280f22-cfe0-30f7-9249-0c317ccfd5dc","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.30.0 \u003c2.30.1"}],"enisaIdVendor":[{"id":"165a9a47-0ca0-3ce4-b6d4-1a60c523a992","vendor":{"name":"n8n-io"}}],"enisaIdVulnerability":[{"id":"422c489e-3286-354a-90cf-de916a387710","vulnerability":{"id":"GHSA-9wcp-9r3j-383q","description":"n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`","datePublished":"Jul 22, 2026, 5:59:07 PM","dateUpdated":"Jul 22, 2026, 5:59:07 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-9wcp-9r3j-383q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65592\nhttps://github.com/n8n-io/n8n\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1\nhttps://www.vulncheck.com/advisories/n8n-before-stored-dom-xss-via-cachedresulturl\n","enisa_id":"EUVD-2026-47636\n","aliases":"GHSA-9wcp-9r3j-383q\nCVE-2026-65592\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"98dfc8b6-88c6-3b98-8d03-bdb00f4d3fd8","vulnerability":{"id":"GHSA-h5xr-fqvj-253p","description":"Duplicate Advisory: Stored DOM XSS via Resource Locator `cachedResultUrl`","datePublished":"Jul 22, 2026, 12:32:17 PM","dateUpdated":"Jul 22, 2026, 5:58:48 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-9wcp-9r3j-383q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65592\nhttps://www.vulncheck.com/advisories/n8n-before-stored-dom-xss-via-cachedresulturl\n","enisa_id":"EUVD-2026-47636\n","aliases":"GHSA-h5xr-fqvj-253p\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b2983c76-d8be-30c0-929d-9d4ff507f92f","vulnerability":{"id":"CVE-2026-65592","description":"n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim\u0027s browser.","datePublished":"Jul 22, 2026, 11:21:41 AM","dateUpdated":"Oct 29, 2026, 9:16:23 PM","status":"PUBLISHED","baseScore":8.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-9wcp-9r3j-383q\nhttps://www.vulncheck.com/advisories/n8n-before-stored-dom-xss-via-cachedresulturl\n","enisa_id":"EUVD-2026-47636\n","assigner":"VulnCheck","epss":0.24,"dataProcessed":"Nov 5, 2026, 7:16:29 AM","vulnerabilityProduct":[{"id":"1057c251-0901-3933-b70c-a0eb1b9eb464","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"0 \u003c1.123.64"},{"id":"15c022ac-6e3e-3ae1-9f12-6d8575c927d4","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0-rc.0 \u003c2.29.8"},{"id":"37563cba-a98d-3786-aa34-d48d741af345","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.30.0 \u003c2.30.1"}],"vulnerabilityVendor":[{"id":"3941474c-e2c6-32ac-8c0a-9581586edc84","vendor":{"name":"n8n-io"}}]}}],"enisaIdAdvisory":[]}