{"id":"EUVD-2026-47641","enisaUuid":"02c4eb17-18a3-3749-a866-4ec4719b92ad","description":"n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim\u0027s session. An account with global:member privileges can exploit the issue.","datePublished":"Jul 22, 2026, 11:21:44 AM","dateUpdated":"Oct 29, 2026, 9:16:26 PM","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-p3rg-hrf9-w9gj\nhttps://www.vulncheck.com/advisories/n8n-before-dom-based-xss-via-unsandboxed-iframe\n","aliases":"CVE-2026-65597\nGHSA-vhcw-f978-xjjg\nGHSA-p3rg-hrf9-w9gj\n","assigner":"VulnCheck","epss":0.3,"enisaIdProduct":[{"id":"459a1830-2297-3985-a144-c687178960d7","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0-rc.0 \u003c2.29.8"},{"id":"78f6a0f0-b117-3693-b355-f213eca3d999","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.30.0 \u003c2.30.1"},{"id":"997af367-cebf-3de4-b33b-da56500627f3","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"0 \u003c1.123.64"}],"enisaIdVendor":[{"id":"5f8cc881-312e-37bf-b039-c60e91aacdc3","vendor":{"name":"n8n-io"}}],"enisaIdVulnerability":[{"id":"0e158194-8cb7-3374-97f3-c50af6782a14","vulnerability":{"id":"CVE-2026-65597","description":"n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim\u0027s session. An account with global:member privileges can exploit the issue.","datePublished":"Jul 22, 2026, 11:21:44 AM","dateUpdated":"Oct 29, 2026, 9:16:26 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-p3rg-hrf9-w9gj\nhttps://www.vulncheck.com/advisories/n8n-before-dom-based-xss-via-unsandboxed-iframe\n","enisa_id":"EUVD-2026-47641\n","assigner":"VulnCheck","epss":0.3,"dataProcessed":"Nov 1, 2026, 7:17:00 AM","vulnerabilityProduct":[{"id":"255a5529-6c2e-3512-9ca9-20ee8a771fdf","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"0 \u003c1.123.64"},{"id":"761b2630-b51f-32dd-b617-9b7071e8d02d","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.30.0 \u003c2.30.1"},{"id":"94bc704b-ca7e-30b4-94be-a6c6dc9cf6d3","product":{"name":"n8n","vendor":{"name":"n8n-io"}},"product_version":"2.0.0-rc.0 \u003c2.29.8"}],"vulnerabilityVendor":[{"id":"9ddfd759-9d34-3de5-9ff4-d1dfd4aa952b","vendor":{"name":"n8n-io"}}]}},{"id":"14a23d8f-70a7-355e-a482-e5e64d257b45","vulnerability":{"id":"GHSA-p3rg-hrf9-w9gj","description":"n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview","datePublished":"Jul 22, 2026, 5:57:14 PM","dateUpdated":"Jul 22, 2026, 5:57:15 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-p3rg-hrf9-w9gj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65597\nhttps://github.com/n8n-io/n8n\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8\nhttps://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1\nhttps://www.vulncheck.com/advisories/n8n-before-dom-based-xss-via-unsandboxed-iframe\n","enisa_id":"EUVD-2026-47641\n","aliases":"GHSA-p3rg-hrf9-w9gj\nCVE-2026-65597\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"7abbb6f9-fd95-321a-80ce-13810b30bafb","vulnerability":{"id":"GHSA-vhcw-f978-xjjg","description":"Duplicate Advisory: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview","datePublished":"Jul 22, 2026, 12:32:18 PM","dateUpdated":"Jul 22, 2026, 5:55:01 PM","baseScore":0.0,"references":"https://github.com/n8n-io/n8n/security/advisories/GHSA-p3rg-hrf9-w9gj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65597\nhttps://www.vulncheck.com/advisories/n8n-before-dom-based-xss-via-unsandboxed-iframe\n","enisa_id":"EUVD-2026-47641\n","aliases":"GHSA-vhcw-f978-xjjg\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}