CVE-2026-119408
n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.
| CWE | CWE-653 |
| Vendor | n8n-io |
| Product | n8n |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for n8n-io n8n
Be the first to know when new high vulnerabilities affecting n8n-io n8n are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
n8n-io / n8n
2.43.0 < 2.43.3
n8n-io / n8n
0 < 2.42.6
n8n-io / n8n
3.0.0 < 3.0.1
References
github.com: https://github.com/n8n-io/n8n/security/advisories/GHSA-9p7v-45m2-wxgj github.com: https://github.com/n8n-io/n8n/commit/ea8417e29ad6f8b981d9a04b17283d5d77f2b5bb github.com: https://github.com/n8n-io/n8n/blob/[email protected]/packages/nodes-base/nodes/Function/Function.node.ts#L167 github.com: https://github.com/n8n-io/n8n/releases/tag/[email protected] github.com: https://github.com/n8n-io/n8n/releases/tag/[email protected] github.com: https://github.com/n8n-io/n8n/releases/tag/[email protected] abraxaslabs.tech: https://abraxaslabs.tech/research/n8n-function-vm2 github.com: https://github.com/n8n-io/n8n vulncheck.com: https://www.vulncheck.com/advisories/n8n-before-2.42.6-2.43.3-and-3.0.1-code-execution-outside-task-runner-isolation-via-deprecated-function-nodes
Credits
🔍 Abraxas Labs mfsiega