GHSA-9p7v-45m2-wxgj: n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes
n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated n8n user who can create, modify, or import workflows can exploit it. The workflow must name one of the hidden deprecated node types: Function, Function Item, or LangChain Code.
What is the impact of successful exploitation?
An attacker can execute JavaScript in the n8n main process, outside task runner isolation. This can result in remote code execution with high impact to confidentiality, integrity, and availability.
Which versions need remediation?
Affected versions are n8n releases before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1. Upgrade to 2.42.6, 2.43.3, 3.0.1, or a later applicable release.