n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor. When a victim opens the preview, the script can call authenticated APIs using the victim's session. An account with global:member privileges can exploit the issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.123.64CPE matchmatch criteria | cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:* | ||
< 1.123.64CPE matchmatch criteria | cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:* | ||
>= 2.0.0, < 2.29.8CPE matchmatch criteria | cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:* | ||
>= 2.0.0, < 2.29.8CPE matchmatch criteria | cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:* | ||
2.30.0CPE matchmatch criteria | cpe:2.3:a:n8n:n8n:2.30.0:*:*:*:community:node.js:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.