CVE-2026-119408

n8n deprecated Function and LangChain nodes run code outside task-runner isolation

n8n · Deprecated Function, Function Item and LangChain Code nodes

First documented disclosure · Review checkpoint

Summary

Hidden legacy nodes still execute workflow code in the n8n main process.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: A controlled local lab demonstrated main-process execution by an ordinary member. No malicious campaign or confirmed victim is established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Function/Function Item use an in-process vm2 sandbox; LangChain Code also executes outside the separate task runner. Hiding these node types from the palette does not block workflow JSON import or execution.

Conditions required

An authenticated user can create, modify or import and run workflows naming the affected node types.

Potential impact

Code execution with the n8n process privileges, potentially exposing instance secrets and other users’ data. This is not unauthenticated access or operating-system privilege escalation.

Affected versions and configurations

Before 2.42.6; 2.43.x before 2.43.3; 3.x before 3.0.1, according to the CNA.

Fix and mitigation status

2.42.6, 2.43.3, 2.44.0 and 3.0.1 block new or modified deprecated nodes by default. Previously saved workflows containing them continue to run.

Practical next steps

Upgrade and replace existing deprecated nodes with the Code node. Keep N8N_DEPRECATED_NODES_BLOCK enabled; setting it false restores vulnerable behavior. Before upgrading, exclude the three node types and restrict workflow creation/editing to fully trusted users.

Operating lesson

Removing an unsafe tool from the interface does not remove its execution path; migrated instances also need stored-workflow cleanup.

Evidence and limits

September 29 is the full public researcher report, earlier than the October 28 GHSA and October 30 CNA. The linked fix merged October 8, with 2.42.6/2.43.3 releases October 9. An older PR opening date alone does not date its subsequently edited security description. The CNA’s October 28 datePublic refers to the later advisory. Existing saved-workflow execution and the opt-out setting are explicit limits of the fix. The separate Code-node/task-runner work is not this issue.

Sources