A stored cross–site scripting flaw exists in the Resource Locator component of n8n. The flaw arises because the cachedResultUrl workflow parameter is passed directly to window.open() without validating its scheme. When a maliciously crafted workflow is opened and the user interacts with external links, the payload, such as a javascript: link, executes in the victim’s browser, enabling the attacker to run arbitrary JavaScript in the user's context. This can lead to credential hijacking, session theft, or other client‑side attacks.

The vulnerability affects n8n versions prior to 1.123.64, 2.29.8, and 2.30.1. All users running these releases and having workflow creation or editing permissions are potentially exposed.

The CVSS score of 8.4 indicates a high severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. An attacker with workflow creation or editing privileges can embed a malicious cachedResultUrl value; when the victim later opens that workflow and interacts with external links, the script runs in the victim’s browser. The attack requires legitimate application access but no additional networking or OS privileges.