{"data":{"id":"e8c95a47-fb92-4a45-8b90-2b8730257e41","title":"GHSA-h5xr-fqvj-253p: Duplicate Advisory: Stored DOM XSS via Resource Locator `cachedResultUrl`","summary":"This advisory was withdrawn as a duplicate of GHSA-9wcp-9r3j-383q and is kept only to preserve external references. The original description covers n8n before 1.123.64, 2.29.8, and 2.30.1, where the Resource Locator component passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation or editing privileges can store a javascript: URL there, and it runs in a victim's browser when the victim opens the workflow and clicks external links.","solution":"Fixed in n8n 1.123.64, 2.29.8, and 2.30.1, as the affected version ranges imply. See GHSA-9wcp-9r3j-383q for the primary advisory.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-h5xr-fqvj-253p","publishedAt":"2026-07-22T12:32:17.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["n8n@< 1.123.64"],"affectedPackageNames":["n8n"],"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["n8n"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-h5xr-fqvj-253p"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-07-22T12:32:17.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.7,"researchCategory":null,"atlasIds":null,"fixes":[]}}