GHSA-h5xr-fqvj-253p: Duplicate Advisory: Stored DOM XSS via Resource Locator `cachedResultUrl`
- Identifier
- GHSA-h5xr-fqvj-253p
- Published
- Record updated
- Affected
- n8n < 1.123.64
- Fixed in
- No fixed version was stated when the source was last read.
Summary
This advisory was withdrawn as a duplicate of GHSA-9wcp-9r3j-383q and is kept only to preserve external references. The original description covers n8n before 1.123.64, 2.29.8, and 2.30.1, where the Resource Locator component passes the workflow-persisted cachedResultUrl parameter to window.open() without scheme validation. An attacker with workflow creation or editing privileges can store a javascript: URL there, and it runs in a victim's browser when the victim opens the workflow and clicks external links.
Mitigation
Fixed in n8n 1.123.64, 2.29.8, and 2.30.1, as the affected version ranges imply. See GHSA-9wcp-9r3j-383q for the primary advisory.
Affected packages in the Exposure Registry
Matched by package name. An entry matched by name alone may be a different package of the same name in another ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- n8nnpmLLM dependency since 2026-02-10
Related items
- MediumCVE-2026-127202: MLflow path traversal through model_id in the log outputs APISimilar attack · NVD/CVE Database
- LowAI chatbots are recommending fake retail websites, study findsSimilar attack · The Verge (AI)
- MediumPalo Alto tracks a massive Chinese AI attack that sadly lives up to industry fearsSimilar attack · CSO Online
- MediumAttackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society SectorsSimilar attack · Palo Alto Unit 42
- MediumCVE-2026-126994: braindecode model config deserialization flaw via activation argumentSimilar attack · NVD/CVE Database