CVE-2026-119408
Deferred Deferred - Pending Action

Remote Code Execution in n8n Workflow Nodes

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119408
EUVD
EUVD-2026-113792

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
n8n-io n8n 2.43.0
n8n-io n8n 0
n8n-io n8n 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-653 The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-119408 is a remote code execution vulnerability in n8n, an open-source workflow automation tool. It affects versions before 2.42.6, 2.43.3, and 3.0.1. The issue involves deprecated Function, Function Item, and LangChain Code nodes that run user-provided JavaScript code outside the secure task runner isolation environment. Authenticated users with workflow modification permissions can exploit this to execute malicious code in the n8n main process, potentially compromising system confidentiality, integrity, and availability.

Detection Guidance

Check n8n version with 'n8n --version' or inspect package.json. Look for deprecated nodes (Function, Function Item, LangChain Code) in workflows. Monitor for unauthorized workflow modifications or unexpected JavaScript execution logs.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary JavaScript code with high privileges in the n8n main process. This could lead to unauthorized access to sensitive data, system compromise, or disruption of services. Attackers could steal instance secrets, user credentials, or database contents. The impact depends on the n8n instance's configuration and permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. A successful exploit may result in non-compliance due to potential breaches of confidentiality, integrity, and availability of sensitive data processed by n8n workflows.

Mitigation Strategies

Upgrade to n8n 2.42.6, 2.43.3, or 3.0.1 or later. Set N8N_DEPRECATED_NODES_BLOCK=true to prevent saving/importing workflows with deprecated nodes. Restrict workflow creation/modification permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119408. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart