n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`

Impact The Resource Locator passes the workflow-persisted cachedResultUrl to window.open without scheme validation. When a victim opens the crafted workflow and interact with external links, the JavaScript payload runs in the victim's browser. Patches The issue has been fixed in n8n versions...

CVE-2026-16157

creationtimestamp| type| source ---|---|--- 2026-07-22 17:50:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrav5ilsmq2i...

CVE-2026-16607

creationtimestamp| type| source ---|---|--- 2026-07-22 17:24:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mratp72ovt2x...

CVE-2026-13190

creationtimestamp| type| source ---|---|--- 2026-07-22 17:19:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mratgahzzr24...

CVE-2026-13187

creationtimestamp| type| source ---|---|--- 2026-07-22 17:18:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrategwpze2g...

CVE-2026-11331

creationtimestamp| type| source ---|---|--- 2026-07-22 16:47:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrarlpzzf32u 2026-07-22 19:01:40+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mraz4gyvek2o...

CVE-2026-11605

creationtimestamp| type| source ---|---|--- 2026-07-22 16:47:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrarlpzzf32u 2026-07-22 19:01:40+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mraz4gyvek2o...

CVE-2026-11721

creationtimestamp| type| source ---|---|--- 2026-07-22 16:47:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrarlpzzf32u 2026-07-22 19:01:40+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mraz4gyvek2o 2026-07-23 13:46:13+00:00| seen|...

CVE-2026-10723

creationtimestamp| type| source ---|---|--- 2026-07-22 16:47:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrarlpzzf32u 2026-07-22 19:01:40+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mraz4gyvek2o 2026-10-15 21:00:00+00:00| seen|...

CVE-2026-13183

creationtimestamp| type| source ---|---|--- 2026-07-22 16:36:08+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mraqyblluc2p 2026-09-08 22:20:02+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mv22lawitc2a 2026-09-09 03:00:05+00:00| seen|...

CVE-2026-44878

creationtimestamp| type| source ---|---|--- 2026-07-22 14:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mraldxwopq2n...

CVE-2026-55717

creationtimestamp| type| source ---|---|--- 2026-07-22 14:41:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrakkgvgsy2a...

GHSA-C35G-MGC3-95RX

creationtimestamp| type| source ---|---|--- 2026-07-22 14:30:53+00:00| seen| https://infosec.exchange/users/mmguero/statuses/116964108001076474...

CVE-2026-56444

creationtimestamp| type| source ---|---|--- 2026-07-22 14:06:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mraimgxtjj2j...

CVE-2026-65598

creationtimestamp| type| source ---|---|--- 2026-07-22 13:04:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mraf5rtpf62i 2026-07-28 18:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrq2k4jcre22...

GHSA-38FJ-36M5-783C Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9w78-79q7-r4fp. This link is maintained to preserve external references. Original Description n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters...

GHSA-H5XR-FQVJ-253P Duplicate Advisory: Stored DOM XSS via Resource Locator `cachedResultUrl`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9wcp-9r3j-383q. This link is maintained to preserve external references. Original Description n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripting vulnerability in the Resource...

CVE-2026-65593

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n...

GHSA-XJ6Q-8X83-JV6G

creationtimestamp| type| source ---|---|--- 2026-07-22 12:01:05+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mrabmi3jbs2x...

GHSA-MWF2-3PR3-8698

creationtimestamp| type| source ---|---|--- 2026-07-22 12:01:02+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mrabmenwc72g 2026-08-12 12:01:34+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3msv3gnshgq2p...