CVE-2026-119408

n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://abraxaslabs.tech/research/n8n-function-vm2
https://github.com/n8n-io/n8n
https://github.com/n8n-io/n8n/blob/n8n@2.42.0/packages/nodes-base/nodes/Function/Function.node.ts#L167
https://github.com/n8n-io/n8n/commit/ea8417e29ad6f8b981d9a04b17283d5d77f2b5bb
https://github.com/n8n-io/n8n/releases/tag/n8n@2.42.6
https://github.com/n8n-io/n8n/releases/tag/n8n@2.43.3
https://github.com/n8n-io/n8n/releases/tag/n8n@3.0.1
https://github.com/n8n-io/n8n/security/advisories/GHSA-9p7v-45m2-wxgj
https://www.vulncheck.com/advisories/n8n-before-2.42.6-2.43.3-and-3.0.1-code-execution-outside-task-runner-isolation-via-deprecated-function-nodes

Configurations

No configuration.

History

30 Oct 2026, 12:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-30 12:16

Updated : 2026-10-30 12:16

NVD link : CVE-2026-119408

Mitre link : CVE-2026-119408

CVE.ORG link : CVE-2026-119408

JSON object : View

Products Affected

No product.

CWE

CWE-653

Improper Isolation or Compartmentalization

{"id": "CVE-2026-119408", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "2.43.0", "lessThan": "2.43.3", "versionType": "semver"}, {"status": "unaffected", "version": "2.43.3", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}, {"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "0", "lessThan": "2.42.6", "versionType": "semver"}, {"status": "unaffected", "version": "2.42.6", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}, {"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.0.1", "versionType": "semver"}, {"status": "unaffected", "version": "3.0.1", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}]}], "published": "2026-10-30T12:16:37.283", "references": [{"url": "https://abraxaslabs.tech/research/n8n-function-vm2", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/n8n-io/n8n", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/n8n-io/n8n/blob/n8n@2.42.0/packages/nodes-base/nodes/Function/Function.node.ts#L167", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/n8n-io/n8n/commit/ea8417e29ad6f8b981d9a04b17283d5d77f2b5bb", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.42.6", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.43.3", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/n8n-io/n8n/releases/tag/n8n@3.0.1", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-9p7v-45m2-wxgj", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/n8n-before-2.42.6-2.43.3-and-3.0.1-code-execution-outside-task-runner-isolation-via-deprecated-function-nodes", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-653"}]}], "descriptions": [{"lang": "en", "value": "n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process."}], "lastModified": "2026-10-30T12:16:37.413", "sourceIdentifier": "disclosure@vulncheck.com"}