---
id: CVE-2026-119408
title: >-
  n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner
  Isolation via Deprecated Function Nodes
summary: >-
  n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a
  remote code execution vulnerability via deprecated Function, Function Item,
  and LangChain Code nodes running outside task runner isolation. Authenticated
  users who …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-653
vendor: n8n-io
product: n8n
affected:
  - n8n >= 2.43.0 < 2.43.3
  - n8n < 2.42.6
  - n8n >= 3.0.0 < 3.0.1
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T11:30:45.729Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119408'
references:
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-9p7v-45m2-wxgj'
    label: GitHub Security Advisory (GHSA-9p7v-45m2-wxgj)
  - url: >-
      https://github.com/n8n-io/n8n/commit/ea8417e29ad6f8b981d9a04b17283d5d77f2b5bb
  - url: >-
      https://github.com/n8n-io/n8n/blob/n8n@2.42.0/packages/nodes-base/nodes/Function/Function.node.ts#L167
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@2.42.6'
    label: n8n n8n@2.42.6 Release Notes
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@2.43.3'
    label: n8n n8n@2.43.3 Release Notes
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@3.0.1'
    label: n8n n8n@3.0.1 Release Notes
  - url: 'https://abraxaslabs.tech/research/n8n-function-vm2'
  - url: 'https://github.com/n8n-io/n8n'
  - url: >-
      https://www.vulncheck.com/advisories/n8n-before-2.42.6-2.43.3-and-3.0.1-code-execution-outside-task-runner-isolation-via-deprecated-function-nodes
    label: >-
      VulnCheck Advisory: n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution
      Outside Task Runner Isolation via Deprecated Function Nodes
tags:
  - cve.org
epss: 0.00627
epssPercentile: 0.50071
ingestedAt: '2026-11-03T10:42:03.638Z'
---

## Overview

n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.

## Affected

- `n8n >= 2.43.0 < 2.43.3`
- `n8n < 2.42.6`
- `n8n >= 3.0.0 < 3.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.