Evidence · DiggingBeagle record
n8n legacy Function and LangChain Code main-process execution advisory
Security advisory identifying authenticated workflow author execution outside isolated task runners.
- Source role
- primary disclosure
Evidence record
Security advisory identifying authenticated workflow author execution outside isolated task runners.
Claim-level citations (2)
- supportsn8n saved legacy Code workflows could bypass task-runner isolation: The n8n legacy-code advisory distinguishes blocking new deprecated code-node edits from stopping previously stored instances, which can continue running in the main process on affected configurations.
GHSA-9p7v-45m2-wxgj: affected legacy nodes, runtime isolation and patch behavior
- supportsn8n saved legacy Code workflows could bypass task-runner isolation: Deprecated n8n Function, Function Item and LangChain Code paths used a main-process execution environment instead of the isolated task runner. Exploitation required an account permitted to author or activate affected workflows; this did not create anonymous execution access. The vulnerable paths could execute workflow-supplied JavaScript with the n8n server process authority, and preexisting saved nodes remained a residual risk after initial fixes.
GHSA-9p7v-45m2-wxgj: affected legacy nodes, runtime isolation and patch behavior