CVE-2026-119408High· 8.8▾ Twilightn8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.6%
n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.
n8n >= 2.43.0 < 2.43.3n8n < 2.42.6n8n >= 3.0.0 < 3.0.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-72775Medium· 5.8n8n before 1.123.67 SQL Injection via PostgresTrigger Node
CVE-2026-72771High· 7.1n8n before 2.32.1 Credential Restriction Bypass via AI/LLM Nodes
CVE-2026-72773Medium· 4.9n8n before 2.32.1 Path Traversal via computer-use search_files
CVE-2026-72770High· 7.1n8n before 1.123.67 Path Traversal via Git Node Operations
CVE-2026-72768Medium· 6.4n8n before 2.32.1 SSRF Protection Bypass via MCP Client
CVE-2026-72766High· 8.2n8n before 1.123.67 Arbitrary File Read via Send Email Node