n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

Impact The HTML preview renders execution output into an iframe srcdoc without sandbox, so a sanitizer bypass lets injected script run same-origin as the editor. When a victim opens the preview, it can call authenticated APIs with their session. An account with global:member privileges can exploi...

GHSA-P3RG-HRF9-W9GJ n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

Impact The HTML preview renders execution output into an iframe srcdoc without sandbox, so a sanitizer bypass lets injected script run same-origin as the editor. When a victim opens the preview, it can call authenticated APIs with their session. An account with global:member privileges can exploi...

NPM: n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

NPM: n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

Duplicate Advisory: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p3rg-hrf9-w9gj. This link is maintained to preserve external references. Original Description n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in...

GHSA-VHCW-F978-XJJG Duplicate Advisory: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p3rg-hrf9-w9gj. This link is maintained to preserve external references. Original Description n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in...

Cross-site Scripting (XSS)

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Cross-site Scripting XSS in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. An attacker can execute arbitrary scripts in the context of the...

CVE-2026-65597

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor...

EUVD-2026-47641

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor...

CVE-2026-65597

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor...

CVE-2026-65597

Summary: The CVE affects n8n prior to 1.123.64 and 2.x prior to 2.29.8, and before 2.30.1. Vulnerability: DOM-based XSS in the HTML preview that renders output into an iframe srcdoc without the sandbox attribute, enabling a sanitizer bypass and same-origin script execution as the editor. Impact: ...

CVE-2026-65597 n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor...

CVE-2026-65597 n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor...

CVE-2026-65597 n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor...

PT-2026-63355

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1 Description A DOM-based cross-site scripting issue exists in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox...

CVE-2026-65597: Improper Neutralization of Input During Web Page Generation

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor...

PT-2026-26931

The module and certain submodules AI Automators, AI Translate, AI API Explorer, AI Content Suggestions provide the ability to use an LLM to generate HTML or Markdown and preview it in a browser. Under certain circumstances, rendering of this HTML can lead to exposing secret communications in the...

EUVD-2021-2115

Malware in sbrugna...

EUVD-2023-43653

Malicious code in bioql PyPI...

CVE-2025-50733

NextChat contains a cross-site scripting XSS vulnerability in the HTMLPreview component of artifacts.tsx that allows attackers to execute arbitrary JavaScript code when HTML content is rendered in the AI chat interface. The vulnerability occurs because user-influenced HTML from AI responses is...

CVE-2025-50733

NextChat contains a cross-site scripting XSS vulnerability in the HTMLPreview component of artifacts.tsx that allows attackers to execute arbitrary JavaScript code when HTML content is rendered in the AI chat interface. The vulnerability occurs because user-influenced HTML from AI responses is...