n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource Locator component, which passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation/editing privileges can craft a workflow with a malicious (e.g., javascript:) scheme in cachedResultUrl; when a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://github.com/n8n-io/n8n/security/advisories/GHSA-9wcp-9r3j-383q Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.4 · n8nNVD modified 2026-10-24 17:10
Affected (CPE criteria) 4
cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*cpe:2.3:a:n8n:n8n:2.30.0:*:*:*:community:node.js:*:*cpe:2.3:a:n8n:n8n:2.30.0:*:*:*:enterprise:node.js:*:*
References 2
- https://github.com/n8n-io/n8n/security/advisories/GHSA-9wcp-9r3j-383q Mitigation, Vendor Advisory
- https://www.vulncheck.com/advisories/n8n-before-stored-dom-xss-via-cachedresulturl Third Party Advisory