n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`

HighCVE-2026-65592 · Published Jul 22, 2026

## Impact The Resource Locator passes the workflow-persisted `cachedResultUrl` to `window.open()` without scheme validation. When a victim opens the crafted workflow and interact with external links, the JavaScript payload runs in the victim's browser. ## Patches The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict workflow creation and editing permissions to fully trusted users only. - Audit existing workflows for unexpected `cachedResultUrl` values containing non-HTTP(S) schemes. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.