8.8
CVSS 3.1
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.
Описание
Оригинално описание
n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden node types can execute JavaScript in the n8n main process.
Засегнати продукти
- n8n-io n8n: 2.43.0 преди 2.43.3; 2.43.3
- n8n-io n8n: преди 2.42.6; 2.42.6
- n8n-io n8n: 3.0.0 преди 3.0.1; 3.0.1
Вид слабост
История
- 30 октомври 2026 Публикувано
Други уязвимости в n8n-io n8n
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-119408
- https://nvd.nist.gov/vuln/detail/CVE-2026-119408
- https://github.com/n8n-io/n8n/security/advisories/GHSA-9p7v-45m2-wxgj
- https://github.com/n8n-io/n8n/commit/ea8417e29ad6f8b981d9a04b17283d5d77f2b5bb
- https://github.com/n8n-io/n8n/blob/[email protected]/packages/nodes-base/nodes/Function/Function.node.ts#L167
- https://github.com/n8n-io/n8n/releases/tag/[email protected]
- https://github.com/n8n-io/n8n/releases/tag/[email protected]
- https://github.com/n8n-io/n8n/releases/tag/[email protected]
- https://abraxaslabs.tech/research/n8n-function-vm2
- https://github.com/n8n-io/n8n
- https://www.vulncheck.com/advisories/n8n-before-2.42.6-2.43.3-and-3.0.1-code-execution-outside-task-runner-isolation-via-deprecated-function-nodes