Code Injection in n8n - CVE-2026-119408
Published: November 9, 2026 / Updated: November 10, 2026
Vulnerability identifier: #VU163072
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119408
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker to execute arbitrary code in the n8n main process outside task runner isolation.
The vulnerability exists due to insufficient isolation of user code executed through the deprecated Function, Function Item, and LangChain Code workflow nodes. An authenticated attacker with permission to create or modify workflows can place malicious code in these nodes and execute a workflow to run it in the main process.
Affected software
n8n
How to mitigate CVE-2026-119408
Install security update from vendor's website.
n8n - addressed in versions 2.42.6, 2.43.3, 3.0.1