CVE-2026-119408

EUVD-2026-113792
n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://abraxaslabs.tech/research/n8n-function-vm2
https://github.com/n8n-io/n8n
https://github.com/n8n-io/n8n/blob/n8n@2.42.0/packages/nodes-base/nodes/Function/Function.node.ts#L167
https://github.com/n8n-io/n8n/commit/ea8417e29ad6f8b981d9a04b17283d5d77f2b5bb
https://github.com/n8n-io/n8n/releases/tag/n8n@2.42.6
https://github.com/n8n-io/n8n/releases/tag/n8n@2.43.3
https://github.com/n8n-io/n8n/releases/tag/n8n@3.0.1
https://github.com/n8n-io/n8n/security/advisories/GHSA-9p7v-45m2-wxgj
https://www.vulncheck.com/advisories/n8n-before-2.42.6-2.43.3-and-3.0.1-code-execution-outside-task-runner-isolation-via-deprecated-function-nodes