AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-119408highCode execution2026-10-30

CVE-2026-119408: n8n's hidden Function and LangChain Code nodes run JavaScript in the main process, upgrade to 2.42.6, 2.43.3 or 3.0.1

In n8n before 2.42.6, 2.43.x before 2.43.3 and 3.x before 3.0.1, the deprecated Function, Function Item and LangChain Code nodes run outside task runner isolation. Any authenticated user who can create, edit or import a workflow that names these hidden node types can run JavaScript inside the n8n main process.

01.

What it is

The deprecated Function and Function Item nodes and the LangChain Code node don't go through n8n's task runner isolation (CWE-653).

They're hidden in the editor, but a workflow that names them, for example an imported JSON file, still runs them.

That gives code execution in the n8n main process, which holds credentials for every connected service.

02.

How to check

  1. Check your n8n version. Affected are versions before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1.
  2. List who can create, edit or import workflows on your instance.
03.

How to fix

  1. Upgrade n8n to 2.42.6, 2.43.3 or 3.0.1 (or later in your release line).
  2. Don't import workflow JSON from people you don't trust.
  3. If untrusted users had workflow edit rights, rotate the credentials stored in n8n.
docker pull n8nio/n8n:3.0.1
# or: npm install -g [email protected]
04.

Sources

More advisories for this tool
The weekly email

One email a week. Only what changed.

Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.