A DOM-based XSS vulnerability in n8n allows authenticated users to execute malicious scripts, potentially leading to unauthorized data access or session compromise.

This is a DOM-based Cross-site Scripting (XSS) flaw categorized under CWE-79. The vulnerability occurs because the application fails to properly sanitize input when handling unsandboxed iframes, allowing an authenticated user with low privileges to trigger script execution in the context of the victim's session.

The successful exploitation of this vulnerability could allow an attacker to hijack user sessions, perform unauthorized actions on behalf of other users, or exfiltrate sensitive workflow data. With a CVSS score of 8.2, this high-severity flaw represents a significant risk to the integrity and confidentiality of the n8n automation platform.

Immediate Action: Update the n8n software to version 1.123.64, 2.30.1, or 2.29.8 depending on your current deployment branch.

Proactive Monitoring: Monitor web application logs for suspicious script injections or unusual iframe-related requests originating from authenticated user sessions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common XSS attack patterns in incoming HTTP requests.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score, administrators should prioritize updating their n8n instances immediately. Applying the provided patch is the only reliable method to remediate the underlying DOM-based XSS flaw and protect the integrity of user sessions within the platform.