Deprecated n8n Function, Function Item and LangChain Code paths used a main-process execution environment instead of the isolated task runner. Exploitation required an account permitted to author or activate affected workflows; this did not create anonymous execution access. The vulnerable paths could execute workflow-supplied JavaScript with the n8n…
Inspect the ClaimsCase · DiggingBeagle record
n8n saved legacy Code workflows could bypass task-runner isolation
Deprecated n8n Function, Function Item and LangChain Code paths used a main-process execution environment instead of the isolated task runner. The vulnerable paths could execute workflow-supplied JavaScript with the n8n server process authority, and preexisting saved nodes remained a residual risk after initial fixes.
Scope
Exploitation required an account permitted to author or activate affected workflows; this did not create anonymous execution access. This is an automation execution boundary, not evidence that an autonomous agent had attacked an n8n production tenant.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The cited primary technical report or advisory supports the stated mechanism within its reported scope. The assessment does not infer a production breach, a victim count or a comparable impact score from a laboratory result. A mitigation or source change is described, but complete repair of every affected deployment is not independently confirmed. Boundary: This failure is not a sandbox escape from the new isolated runner.
Assessed Oct 29, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP23-N8N-LEGACY-MAIN-PROCESS-1 · CLM-ENRICH-20261029-21 · n8n legacy Function and LangChain Code main-process execution advisory
At a glance
The vulnerable paths could execute workflow-supplied JavaScript with the n8n server process authority, and preexisting saved nodes remained a residual risk after initial fixes.
Read the implicationsThis is an automation execution boundary, not evidence that an autonomous agent had attacked an n8n production tenant.
Limits and uncertaintyFull account
Deprecated n8n Function, Function Item and LangChain Code paths used a main-process execution environment instead of the isolated task runner.
Exploitation required an account permitted to author or activate affected workflows; this did not create anonymous execution access. The vulnerable paths could execute workflow-supplied JavaScript with the n8n server process authority, and preexisting saved nodes remained a residual risk after initial fixes.
This is an automation execution boundary, not evidence that an autonomous agent had attacked an n8n production tenant. Upgrade to the relevant patched n8n branch, inventory already saved legacy nodes and require isolated task runners instead of re-enabling deprecated execution.
Evidence interpretation and control boundary. This failure is not a sandbox escape from the new isolated runner. Older saved Function, Function Item and LangChain Code nodes could still execute in the main n8n process after an upgrade that prevented their creation or editing. The operational exposure therefore depends on inventorying persisted workflow definitions and whether the deprecated-node override is enabled; checking the current editor alone is insufficient.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Claims & evidence
CLM-ENRICH-20261029-21The n8n legacy-code advisory distinguishes blocking new deprecated code-node edits from stopping previously stored instances, which can continue running in the main process on affected configurations.supported
Basis: reported finding
- supportsn8n legacy Function and LangChain Code main-process execution advisoryprimary disclosure
GHSA-9p7v-45m2-wxgj: affected legacy nodes, runtime isolation and patch behavior
CLM-CP23-N8N-LEGACY-MAIN-PROCESS-1Deprecated n8n Function, Function Item and LangChain Code paths used a main-process execution environment instead of the isolated task runner. Exploitation required an account permitted to author or activate affected workflows; this did not create anonymous execution access. The vulnerable paths could execute workflow-supplied JavaScript with the n8n server process authority, and preexisting saved nodes remained a residual risk after initial fixes.supported
Basis: reported finding
- supportsn8n legacy Function and LangChain Code main-process execution advisoryprimary disclosure
GHSA-9p7v-45m2-wxgj: affected legacy nodes, runtime isolation and patch behavior
Implications
The vulnerable paths could execute workflow-supplied JavaScript with the n8n server process authority, and preexisting saved nodes remained a residual risk after initial fixes.
Controls and mitigations
- Upgrade to the relevant patched n8n branch, inventory already saved legacy nodes and require isolated task runners instead of re-enabling deprecated execution.
Unknowns and contradictions
- This is an automation execution boundary, not evidence that an autonomous agent had attacked an n8n production tenant.
Sources and citation
Material revision history
- Oct 29, 2026 · Canonical change recorded · new in release · revision 202