n8n CVE-2026-65597

Exploitation requires an authenticated account with global:member privileges to plant the payload (PR:L), and a victim must actively open the HTML preview that renders the malicious execution output (UI:A) - it is not fully automatic. The core enabling condition is n8n's HTML preview rendering output into an <iframe srcdoc> without the sandbox attribute, combined with a bypass of the output sanitizer, so the injected script runs same-origin as the editor. Limiting factors: the attacker needs valid member-level credentials (most relevant to shared, multi-user, or multi-tenant deployments), the victim must open the specific preview, and instances running the fixed versions (1.123.64 / 2.29.8 / 2.30.1) are not vulnerable. Single-user self-hosted instances have little practical exposure since attacker and victim would be the same person.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N, score 8.2 High) is internally consistent with the description: network-reachable, low complexity, but requiring a low-privileged authenticated account (PR:L, i.e., global:member) and active victim interaction (UI:A, the victim must open the preview). The high vulnerable- and subsequent-system confidentiality (VC:H/SC:H) reflects same-origin session and API access. No EPSS score, KEV listing, or POC was provided, so real-world exploitation likelihood cannot be quantified from the input - this is not confirmed actively exploited and no public exploit is identified. Practical risk is moderated by two genuine gating factors: the attacker must already hold a valid member account (relevant mainly to multi-tenant or shared n8n instances), and a higher-privileged victim must open the malicious preview. On a single-admin self-hosted instance the attack surface is minimal; on shared/team deployments it is a credible privilege-escalation and data-exposure path. Treat as a real priority for multi-user n8n instances and lower urgency for single-user deployments.

A user holding a low-privileged global:member account crafts a workflow node whose execution output contains a sanitizer-bypassing HTML/script payload. When a higher-privileged colleague or admin opens the HTML preview of that execution, the script executes in the editor's own origin and silently calls authenticated n8n APIs with the victim's session to exfiltrate credentials, alter workflows, or escalate access. No public exploit code is currently identified, but the described sanitizer bypass and missing iframe sandbox make the technique straightforward to reproduce.