{"data":{"id":"528f771f-68a2-44fe-b004-70e6dec5ab0c","title":"GHSA-9wcp-9r3j-383q: n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`","summary":"n8n (a workflow automation tool) has a stored DOM XSS vulnerability (DOM XSS is when malicious code runs in a user's browser after being stored in an application) in its Resource Locator feature. An attacker can craft a workflow with a malicious `cachedResultUrl` parameter that executes JavaScript when a victim opens the workflow and interacts with external links.","solution":"The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later. If upgrading is not immediately possible, administrators can restrict workflow creation and editing permissions to fully trusted users only, or audit existing workflows for unexpected `cachedResultUrl` values containing non-HTTP(S) schemes. However, these workarounds do not fully remediate the risk and should only be used as short-term measures.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-9wcp-9r3j-383q","publishedAt":"2026-07-22T17:59:07.000Z","cveId":"CVE-2026-65592","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["n8n@>= 2.0.0-rc.0, < 2.29.8 (fixed: 2.29.8)","n8n@>= 2.30.0, < 2.30.1 (fixed: 2.30.1)","n8n@< 1.123.64 (fixed: 1.123.64)"],"affectedVendors":[],"affectedVendorsRaw":["n8n"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":true,"disclosureDate":"2026-07-22T17:59:07.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}