GHSA-p3rg-hrf9-w9gj: n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview
Summary
n8n has a DOM-based XSS (cross-site scripting, where an attacker injects malicious code into a webpage) vulnerability in its HTML preview feature. The preview renders content into an unsandboxed iframe srcdoc (an HTML frame without security restrictions), allowing injected scripts to run with the same permissions as the editor and potentially call authenticated APIs using a victim's session.
Solution / Mitigation
The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later. If upgrading is not immediately possible, administrators can: (1) restrict n8n instance access to fully trusted users only, (2) set the N8N_CONTENT_SECURITY_POLICY environment variable to a policy that blocks inline scripts, or (3) avoid exposing workflows that render externally-controlled input into the HTML node or binary HTML preview to untrusted users. The source notes these workarounds do not fully remediate the risk and should only be used as short-term measures.
Vulnerability Details
EPSS: 0.0%
Yes
July 22, 2026
Classification
Affected Vendors
Affected Packages
Original source: https://github.com/advisories/GHSA-p3rg-hrf9-w9gj
First tracked: July 22, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 95%