unauth

← fix library

HIGH n8n: n8n CVE-2026-65597 — n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

Why it matters

n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

Fix it — 2 steps

  1. Upgrade to 1.123.64 or later. This is the only complete fix.
  2. Until patched, take it off the internet: `sudo ufw deny 5678` or bind it to localhost.

Verify it’s fixed

curl -s http://YOUR_SERVER_IP:5678/rest/settings | grep -o 'n8n@[0-9.]*'  # must be >= 1.123.64

References

Not sure if your stack is exposed?

Run the free check — 30 seconds, safe read-only probes.

Scan your stack