Database/AI/ML frameworks & serving
n8n: deprecated code nodes execute JavaScript in the main process, outside task-runner isolation
Impact
n8n isolates workflow code in a task runner, but three hidden node types - Function, Function Item and the LangChain Code node - still execute in the n8n main process. A user who can create, edit or import a workflow can name one of those node types directly and run arbitrary JavaScript with the privileges of the n8n service itself, escaping the sandbox the deployment is relying on. That reaches every credential n8n holds, which in a fleet-automation or LLM-pipeline role typically includes cluster, registry and model-provider tokens. Importing a workflow JSON from elsewhere is enough to trigger it, so an operator who pastes a shared workflow is the attack path as much as a malicious user is.
Who can reach it
Any authenticated n8n user with permission to create, modify or import workflows. Network access to the n8n UI or API; no unauthenticated path.
What to do
Upgrade to n8n 2.42.6, 2.43.3 or 3.0.1 and restart the n8n service - a daemon restart, no node work. Until then, restrict who can import or author workflows and audit existing workflows for Function, Function Item and LangChain Code node types. Rotate credentials stored in n8n if an untrusted workflow was imported.
References
Related entries
- KubeAI (Ollama engine controller): Injection in `ollamaStartupProbeScript()`CVE-2026-34940 · KubeAI (Ollama engine controller)High
- Flowise: public chatflow endpoints return raw flowData including plaintext API keysCVE-2026-41278 · Flowise (GET /api/v1/public-chatflows/:id and public-chatbotConfig response sanitization)High
- Nocturne Memory: empty API_TOKEN disables auth, exposing the agent knowledge graph to the LANCVE-2026-44830 · Nocturne Memory (BearerTokenAuthMiddleware when API_TOKEN is unset)High
- vLLM: user-supplied structured-output regex compiles with no timeout, hanging an inference workerCVE-2026-55574 · vLLM structured_outputs.regex (xgrammar / outlines grammar compilation)High
- Hugging Face Datasets: pickle-backed pandas builder executes code from a dataset file on loadCVE-2026-57845 · Hugging Face Datasets (deprecated pandas packaged builder, Pandas._generate_tables)High
- XAgent: path traversal in the workspace file endpoint reads any host file outside the Docker sandboxCVE-2026-72713 · XAgent (OpenBMB) workspace file endpoint `/workspace/file`High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.