N8N · GHSA-9p7v-45m2-wxgj · AI agents & MCP
FIX → >= 2.43.3 +2
The Function, Function Item and LangChain Code nodes in n8n run user code inside the main n8n process, outside the sandbox used for the regular Code node. An authenticated user who can create or edit workflows can use them to execute arbitrary code on the n8n server.
first public Oct 28, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any self-hosted or managed n8n instance below the fixed versions where users can create or modify workflows. Instances where only fully trusted users can edit workflows have less exposure, but the advisory says the workarounds do not fully remove the risk. Deployments that never used the Function or LangChain Code nodes can still block them with NODES_EXCLUDE.
Not affected if managed-hosting, workflow-editing-restricted-to-trusted-users
Who cares n8n, self-hosted, workflow-automation
n8n --version or the n8n entry in package.json.N8N_DEPRECATED_NODES_BLOCK is set to , which re-enables the vulnerable behavior.The Function and Function Item nodes run user code in the vm2 sandbox, and the LangChain Code node runs user code in the n8n main process. An authenticated user with permission to create or modify workflows could use these nodes to execute arbitrary code in the n8n main process, outside the task runner isolation that applies to the Code node.
In n8n versions 2.42.6, 2.43.3, 2.44.0 and 3.0.1, the Function, Function Item, and LangChain Code nodes are deprecated and blocked by default. Saving a workflow that adds or modifies one of these nodes is rejected; workflows already saved with these nodes continue to run unchanged. Administrators should review existing workflows and replace these nodes with the Code node.
The block can be disabled with N8N_DEPRECATED_NODES_BLOCK=false, which restores the vulnerable behavior.
Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
n8n-nodes-base.function, n8n-nodes-base.functionItem, and @n8n/n8n-nodes-langchain.code to the NODES_EXCLUDE environment variable to prevent these nodes from being used.Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
falseUpgrade to >= 2.43.3 +2
2.42.6 for the 2.42 line2.43.3 for the 2.43 line3.0.1 for the 3.x line2.44.0 also includes the fix, per the advisory textThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.