A DOM‑based cross‑site scripting flaw exists in the HTML preview feature of n8n. The preview renders execution output into an iframe srcdoc without a sandbox attribute, and a sanitizer bypass permits malicious JavaScript to be injected. The injected script runs in the same origin as the editor, so it can invoke authenticated APIs using the victim’s session. This can expose sensitive data or allow other actions that require the victim’s credentials.

The flaw affects n8n platform releases prior to 1.123.64, the 2.x series before 2.29.8, and any release before 2.30.1. Users running these versions are vulnerable, and an account with global:member privileges can create the malicious content that triggers the preview.

The CVSS score of 8.2 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is currently considered unlikely. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user with global:member or higher privileges to supply malicious content that is later rendered in the preview. When a victim opens the preview, the unsandboxed iframe executes the injected script, giving it same‑origin access to the user’s session and authenticated API endpoints.