Live › vulnerability › CVE-2026-119408
n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 lets authenticated users who can create, modify, or import workflows run JavaScript in the n8n main process through deprecated Function, Function Item, and LangChain Code nodes. The affected nodes run outside task runner isolation, so the attacker can execute code with the privileges of the n8n server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Self-hosted or managed n8n instances where users can create, edit, or import workflows are exposed, since the flaw needs an authenticated account with workflow rights. Instances that only run pre-approved workflows from trusted users, or that are on the fixed versions, are not affected by this flaw.
No product ranges from the sources yet.
n8n --version or the image tag in your deployment.2.42.6 for the 2.42 line2.43.3 for the 2.43 line3.0.1 for the 3.x lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.
This page as .md · .json · in your agent: get_signal("CVE-2026-119408")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.