{"data":{"id":"ac16a483-4d85-4f15-b289-daa73ff82bf9","title":"CVE-2026-119408: n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via…","summary":"n8n versions before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contain CVE-2026-119408, a remote code execution flaw. The deprecated Function, Function Item, and LangChain Code nodes run outside task runner isolation. Authenticated users who can create, modify, or import workflows that name these hidden node types can execute JavaScript in the n8n main process.","solution":"Fixed in n8n 2.42.6, 2.43.3, and 3.0.1, depending on the release line.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-119408","publishedAt":"2026-10-30T12:16:37.283Z","cveId":"CVE-2026-119408","cweIds":["CWE-653"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["n8n","LangChain Code node"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"n8n remote code execution via deprecated Function and LangChain Code nodes","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-30T18:10:28.237Z","kevDateAdded":null,"advisoryAliases":["GHSA-48fh-2c4x-8wcm"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-30T18:10:33.944Z","patchAvailable":null,"disclosureDate":"2026-10-30T12:16:37.283Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[]}}