n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.
Fix
Patch, vendor advisory and mitigation references on NVD 1
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.7 · n8n-ioNVD modified 2026-10-30 11:30
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 9
- https://github.com/n8n-io/n8n/security/advisories/GHSA-9p7v-45m2-wxgj vendor-advisory
- https://github.com/n8n-io/n8n/commit/ea8417e29ad6f8b981d9a04b17283d5d77f2b5bb patch
- https://github.com/n8n-io/n8n/blob/[email protected]/packages/nodes-base/nodes/Function/Function.node.ts#L167 technical-description
- https://github.com/n8n-io/n8n/releases/tag/[email protected] release-notes
- https://github.com/n8n-io/n8n/releases/tag/[email protected] release-notes
- https://github.com/n8n-io/n8n/releases/tag/[email protected] release-notes
- https://abraxaslabs.tech/research/n8n-function-vm2 third-party-advisory
- https://github.com/n8n-io/n8n product
- https://www.vulncheck.com/advisories/n8n-before-2.42.6-2.43.3-and-3.0.1-code-execution-outside-task-runner-isolation-via-deprecated-function-nodes third-party-advisory