All vulnerabilities
GHSA-29xw-66fq-4xc3

n8n: Stored XSS via Same-Origin Blob URL in the Binary-Data File Preview

n8nFrameworks
Open in ThreatlineRecord JSON
CVSS
7.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version yet
Published30 Sep 2026Updated 30 Sep 2026GitHub

What fixes it

No source in this snapshot names a fixed version.

Description

Impact

Binary-data responses are served under a policy that forces them into an opaque origin. The file-preview modal instead re-published the bytes as a same-origin URL in an iframe without the sandbox attribute, and the protecting header does not survive that step. A member who uploads a crafted item can have script run in the n8n origin of whoever previews it, normally the owner reviewing that member's execution output, and act with that person's session.

Patches

The issue has been fixed in n8n versions 1.123.83, 2.42.1 and 2.41.4. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

  • Restrict n8n instance access to fully trusted users only.
  • Avoid opening binary file previews in execution output for executions produced by untrusted members until the instance is patched.
  • Enable a restrictive N8N_CONTENT_SECURITY_POLICY to provide a secondary line of defence against script execution in the n8n origin.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Text from GitHub Advisory Database

Affected versions 3

  • n8n, npm< 1.123.83GitHub
  • n8n, npm< 2.42.1GitHub
  • n8n, npm< 2.41.4GitHub