n8n HTML Preview DOM-Based XSS via Unsandboxed iframe srcdoc (Duplicate Advisory)
First seen Jul 22, 2026 · Updated Jul 22, 2026
This advisory is officially withdrawn as a duplicate of GHSA-p3rg-hrf9-w9gj and is retained only to preserve external references. While the underlying original issue (a DOM-based XSS in n8n's HTML preview feature) may be a genuine vulnerability, this specific record contains no new or independent information and should not be treated as a distinct threat. Severity is set to low here because this entry itself adds nothing actionable beyond pointing to the canonical advisory.
Technical Analysis
The description indicates n8n rendered workflow execution output into an iframe using the srcdoc attribute without the sandbox attribute, and that a sanitizer bypass allowed injected script to run in the same origin as the editor UI. If accurate, an attacker with global:member privileges could craft output that, when previewed by a victim (e.g., an admin), executes script capable of calling authenticated APIs using the victim's session—a privilege escalation via UI trust boundary crossing. However, since this specific GHSA record is a withdrawn duplicate, the authoritative technical details, CVSS score, and remediation should be sourced from GHSA-p3rg-hrf9-w9gj rather than this entry.
Affected Systems
n8n
Detection Signatures
- Advisory status field = 'withdrawn' or 'duplicate'
- Cross-reference GHSA IDs pointing to a canonical advisory (e.g., GHSA-p3rg-hrf9-w9gj) before acting on this record
- Log entries referencing iframe srcdoc rendering of execution output without sandbox attribute in n8n HTML preview feature
Remediation Steps
- 1
Consult canonical advisory
Review GHSA-p3rg-hrf9-w9gj for the authoritative vulnerability details, affected versions, and official remediation guidance instead of this withdrawn duplicate.
- 2
Patch n8n if applicable
If running an affected n8n version per the canonical advisory, upgrade to n8n 1.123.64, 2.29.8, 2.30.1, or later as specified in the primary advisory.
- 3
Harden iframe rendering
Ensure any iframe used to render untrusted or execution-derived HTML content includes the sandbox attribute (e.g., sandbox with no allow-same-origin/allow-scripts) to prevent same-origin script execution.
- 4
Update tracking systems
Update internal vulnerability trackers and SBOM tooling to deduplicate this GHSA ID against the canonical one to avoid redundant alerts or wasted remediation effort.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.