{"schema":"threatline.record/2","record":{"id":"GHSA-29xw-66fq-4xc3","aliases":["GHSA-29xw-66fq-4xc3"],"summary":"Stored XSS via Same-Origin Blob URL in the Binary-Data File Preview","details":"## Impact\n\nBinary-data responses are served under a policy that forces them into an opaque origin. The file-preview modal instead re-published the bytes as a same-origin URL in an iframe without the sandbox attribute, and the protecting header does not survive that step. A member who uploads a crafted item can have script run in the n8n origin of whoever previews it, normally the owner reviewing that member's execution output, and act with that person's session.\n\n## Patches\n\nThe issue has been fixed in n8n versions 1.123.83, 2.42.1 and 2.41.4. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Avoid opening binary file previews in execution output for executions produced by untrusted members until the instance is patched.\n- Enable a restrictive `N8N_CONTENT_SECURITY_POLICY` to provide a secondary line of defence against script execution in the n8n origin.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","categories":["Frameworks"],"product":"n8n","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-29xw-66fq-4xc3","source_modified_at":"2026-09-30T08:35:14Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 1.123.83"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-29xw-66fq-4xc3","source_modified_at":"2026-09-30T08:35:14Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.42.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-29xw-66fq-4xc3","source_modified_at":"2026-09-30T08:35:14Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.41.4"}],"fixed_versions":[],"cvss":7.2,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-30T08:35:14Z","modified_at":"2026-09-30T08:35:14Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-29xw-66fq-4xc3","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-30T08:35:14Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-30T08:35:14Z","content_hash":"e0f3393f46b97f8d00a550197f622f3eac69bc50804b99e7ccf2e1abdf19997d"}}