n8n versions prior to 2.42.6, 2.43.3, and 3.0.1 contain a critical flaw whereby deprecated Function, Function Item, and LangChain Code nodes run outside the intended task‑runner isolation. This allows an authenticated user who can create, modify, or import workflows that reference these hidden node types to execute arbitrary JavaScript within the n8n main process, bypassing the sandbox that normally confines workflow execution. The weakness is a Code Injection flaw (CWE‑653), enabling a user to run untrusted code as the n8n process, potentially compromising the entire host system.

The vulnerability affects the n8n automation server released by n8n‑io. All deployed instances running any of the following version ranges are impacted: any release before 2.42.6, any release before 2.43.3 in the 2.43.x branch, and any release before 3.0.1 in the 3.x branch.

The CVSS score is 8.7, indicating a high severity. The EPSS score is not available, but the existence of the flaw and lack of restrictions on workflow creation for authenticated users suggest a non‑negligible exploitation likelihood. The vulnerability is not currently listed in the CISA KEV catalog, yet the ability to run arbitrary code in the main process constitutes a severe loss of confidentiality, integrity, and availability. The attack vector is inferred to require an authenticated account with permissions to create, modify, or import workflows that include the vulnerable node types. If such a user can import untrusted workflows, the risk of compromise is immediate.