Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-119408: n8n can run malicious JavaScript on your server
CVE-2026-119408 · published 3 days ago
Summary
Versions of n8n before 2.42.6, 2.43.3 and 3.0.1 let a logged‑in user add hidden code blocks that execute JavaScript in the main application process. This can let the user run any commands on the server, potentially compromising data and systems. Upgrade to the latest n8n release or remove the deprecated Function, Function Item, and LangChain Code nodes from your workflows.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| n8n-io | n8n |
< 2.43.3 < 2.42.6 < 3.0.1 |
Original advisory text
n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes
n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.
References
- https://abraxaslabs.tech/research/n8n-function-vm2 Vendor Advisory
- https://github.com/n8n-io/n8n Product
- https://github.com/n8n-io/n8n/blob/[email protected]/packages/nodes-base/nodes/Function... Third Party Advisory
- https://github.com/n8n-io/n8n/commit/ea8417e29ad6f8b981d9a04b17283d5d77f2b5bb Patch
- https://github.com/n8n-io/n8n/releases/tag/[email protected] Vendor Advisory
- https://github.com/n8n-io/n8n/releases/tag/[email protected] Vendor Advisory
- https://github.com/n8n-io/n8n/releases/tag/[email protected] Vendor Advisory
- https://github.com/n8n-io/n8n/security/advisories/GHSA-9p7v-45m2-wxgj Vendor Advisory
- https://www.vulncheck.com/advisories/n8n-before-2.42.6-2.43.3-and-3.0.1-code-exe... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-1194... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-119408 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.4
Critical
Type
CWE-653Improper Isolation or Compartmentalization
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen30 Oct 2026
Sources
CVE-2026-119408 · NVD
CVE-2026-119408 · MITRE
CVE-2026-119408 · OSV
GHSA-9p7v-45m2-wxgj · GHSA
Track software like this
Free during beta