CVE-2026-119408

n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes

State: Published
Severity: 8.7 High
Published: Oct 30, 2026
Updated: Oct 30, 2026
Reserved: Oct 30, 2026

Description

n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-653 Improper Isolation or Compartmentalization

Affected Products

Product	Versions
n8nn8n-io	2.43.0 to before 2.43.3Affected 2.43.3Not affected
n8nn8n-io	before 2.42.6Affected 2.42.6Not affected
n8nn8n-io	3.0.0 to before 3.0.1Affected 3.0.1Not affected

References

GitHub Security Advisory (GHSA-9p7v-45m2-wxgj)vendor-advisory
https://github.com/n8n-io/n8n/commit/ea8417e29ad6f8b981d9a04b17283d5d77f2b5bbpatch
https://github.com/n8n-io/n8n/blob/n8n@2.42.0/packages/nodes-base/nodes/Function/Function.node.ts#L167technical-description
n8n n8n@2.42.6 Release Notesrelease-notes
n8n n8n@2.43.3 Release Notesrelease-notes
n8n n8n@3.0.1 Release Notesrelease-notes
https://abraxaslabs.tech/research/n8n-function-vm2third-party-advisory
https://github.com/n8n-io/n8nproduct
VulnCheck Advisory: n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodesthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.