PatchSiren cyber security CVE debrief
CVE-2026-65592 n8n-io CVE debrief
CVE-2026-65592 is a high-severity vulnerability in n8n, a workflow automation tool. The vulnerability is a stored DOM cross-site scripting (XSS) issue in the Resource Locator component. An attacker with workflow creation or editing privileges can craft a malicious workflow that executes a payload in the victim's browser when interacted with. This vulnerability exists due to the cachedResultUrl parameter being passed to window.open() without scheme validation, allowing for malicious schemes such as javascript: to be executed.
- Vendor
- n8n-io
- Product
- n8n
- CVSS
- HIGH 8.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-22
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-22
- Advisory updated
- 2026-07-22
Who should care
Users of n8n versions before 1.123.64, 2.29.8, and 2.30.1 should apply patches to prevent exploitation of this vulnerability. Security teams and administrators responsible for workflow automation tools should prioritize patching and monitor for potential attacks. Operators of affected systems should review their deployments and apply patches or mitigations as needed.
Technical summary
The vulnerability exists in the Resource Locator component of n8n, where the cachedResultUrl parameter is passed to window.open() without scheme validation. An attacker can craft a workflow with a malicious scheme (e.g., javascript:) in cachedResultUrl. When a victim opens the crafted workflow and interacts with external links, the payload executes in the victim's browser. The affected product deployments should be reviewed for exposure, and patches should be applied to prevent exploitation.
Defensive priority
High
Recommended defensive actions
- Apply patches to upgrade n8n to version 1.123.64, 2.29.8, or 2.30.1.
- Restrict workflow creation and editing privileges to trusted users.
- Monitor for suspicious workflow activity and external link interactions.
- Implement additional security controls, such as input validation and output encoding.
- Review compensating controls for exposed systems while remediation is scheduled and verified.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
- Track exceptions, retest remediated assets, and close the item only after evidence is documented.
Evidence notes
The CVE record was published on 2026-07-22T12:18:19.253Z and last modified on 2026-07-22T16:27:18.220Z. The NVD entry is currently Undergoing Analysis. Limited information is available about the vulnerability's scope and affected systems. The vulnerability exists in n8n versions before 1.123.64, 2.29.8, and 2.30.1. Users should verify their deployments and apply patches or mitigations as needed. The source confidence is limited, and defenders should verify the affected scope and apply patches or mitigations accordingly.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-22T12:18:19.253Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.