CVE-2026-119408

The record

n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.

Affected packages

Related vulnerabilities

• CVE-2026-115517 Unrestricted network access between execution contexts in KNIME Business Hub before… CWE-653
• CVE-2026-15366 A control logic defect in a specific built-in webpage of Kids Mode allows users to view… CWE-653
• CVE-2026-62246 Kamaji is the Hosted Control Plane Manager for Kubernetes. CWE-653
• CVE-2026-65635 Improper Isolation or Compartmentalization vulnerability in malach-it boruta… CWE-653
• CVE-2026-63071 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. CWE-653
• CVE-2026-53421 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. CWE-653
• CVE-2026-53405 Improper Isolation or Compartmentalization vulnerability in Apache Syncope. CWE-653
• CVE-2026-15738 Incorrect behavior order in the Gateway API listener-rule generation in Amazon AWS Load… CWE-653