CVE-2026-119408
n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution…
- Risk score
- 53/100
- CVSS
- 8.8 v3.1
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.42.6, 2.43, 2.43.3 or 3.0.1 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.8 high
References
- https://abraxaslabs.tech/research/n8n-function-vm2
- https://github.com/n8n-io/n8n
- https://github.com/n8n-io/n8n/blob/n8n@2.42.0/packages/nodes-base/nodes/Function/Function.node.ts#L167
- https://github.com/n8n-io/n8n/commit/ea8417e29ad6f8b981d9a04b17283d5d77f2b5bb
- https://github.com/n8n-io/n8n/releases/tag/n8n@2.42.6
- https://github.com/n8n-io/n8n/releases/tag/n8n@2.43.3
- https://github.com/n8n-io/n8n/releases/tag/n8n@3.0.1
- https://github.com/n8n-io/n8n/security/advisories/GHSA-9p7v-45m2-wxgj
- https://www.vulncheck.com/advisories/n8n-before-2.42.6-2.43.3-and-3.0.1-code-execution-outside-task-runner-isolation-via-deprecated-function-nodes
Original description
n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.
Last activity 30 Oct 2026. Patch Forecast updates every hour.