---
id: 2026-10-n8n-october-28-twelve-advisory-batch-deprecated-code-nodes-expression-isolation-graphicsmagick
title: "n8n: twelve advisories on 2026-10-28, three High: deprecated Code nodes run in the main process (8.7), expression-isolation escape, GraphicsMagick RCE; fixed 1.123.89, 2.45.5, 2.46.1"
date_disclosed: 2026-10-28
last_updated: 2026-10-30
severity: high
status: patched
ecosystems: [npm, n8n, ai-agents, mcp]
tools_affected: ["n8n (npm) before 2.45.5 and before 2.46.1 (all twelve); before 1.123.89 on the v1 line (seven of the twelve; the deprecated-nodes 8.7 lists no v1 range)", "n8n Function, Function Item and LangChain Code nodes (deprecated and blocked by default from 2.42.6 / 2.43.3 / 2.44.0)", "n8n Edit Image node (bundled GraphicsMagick in the official Docker image)", "n8n workflow expression evaluation", "n8n Browser Use upload tool", "n8n Chat Trigger embedded chat", "n8n MCP OAuth dynamic client registration endpoints", "n8n NocoDB, MongoDB, Vector Store (OracleDB) and Asana Trigger nodes", "n8n credential-using nodes that follow cross-origin redirects", "n8n Enterprise end-user credential connect flow"]
tags: [n8n, ghsa-batch, workflow-automation, credential-hub, sandbox-escape, rce, image-processing, mcp-oauth, open-redirect, ssrf, credential-leak, sql-injection, patched]
---

## TL;DR
n8n published twelve advisories on 2026-10-28, none with a CVE, and the security team's community bulletin the same morning lists all twelve; the fixes are `2.45.5` (stable) and `2.46.1` (beta) for all twelve and `1.123.89` for the seven that list a v1 range, all on npm between 07:18 and 07:25 UTC; the advisories also name a `3.0.1` that npm does not carry as of 2026-10-28. The three High ones: the deprecated Function, Function Item and LangChain Code nodes let anyone who can edit a workflow run code in the n8n main process outside the task-runner sandbox (GHSA-9p7v-45m2-wxgj, 8.7; blocked by default since 2.42.6 / 2.43.3 / 2.44.0 on 10-09 and 10-13), workflow expression evaluation could be escaped for code execution on the host (GHSA-gx3v-3x3v-f8r5, 7.7), and the GraphicsMagick build in the official Docker image carries known component flaws, so an untrusted image through the Edit Image node could run code on the instance (GHSA-f2cw-9483-7vcp, 7.7). The nine Moderates include the MCP OAuth registration endpoints acting as an unauthenticated open redirector, the Browser Use upload tool reading any file the n8n process can read, and three more credential-leak paths. Upgrade; the vendor labels every workaround short-term.

## What happened

This is the seventh n8n batch since July ([July](2026-07-n8n-july-security-advisory-batch.md), [September 30](2026-09-n8n-september-30-ten-advisory-batch.md), [October 14](2026-10-n8n-october-14-ten-advisory-batch-data-table-cross-project-webhook-xss.md)), published by the same maintainer account with "No known CVE" on every page. The vendor tab shows ten rows on page 1 and two more on page 2 dated 2026-10-28, and the community bulletin "Security update — 28 October 2026" (The n8n Security Team, 09:18) lists the same twelve, three High and nine Medium. The fix versions on npm: `1.123.89` at 07:18 UTC, `2.45.5` at 07:22 (`latest` and `stable`), `2.46.1` at 07:25 (`beta`, `next`, `rc`). Every advisory also lists `3.0.1` as a patched version and the bulletin says "v3: patched in v3.0.1"; `npm view n8n versions` returns no 3.x release and `npm view n8n@3.0.1` is a 404 as of 2026-10-28, so a v3 line exists in the vendor's advisory metadata and not on the registry. This file prints the versions a reader can install. Ranked by the vendor's CVSS 4.0 scores:

- **GHSA-9p7v-45m2-wxgj — Deprecated Code Nodes Allow Code Execution in the n8n Main Process (8.7, High).** The Function and Function Item nodes run user code in the vm2 sandbox, and the LangChain Code node runs it directly in the main process, so a user who can create or modify workflows runs code outside the task-runner isolation the standard Code node uses. The fix deprecates the three node types and blocks them by default in 2.42.6, 2.43.3, 2.44.0 and 3.0.1: saving a workflow that adds or changes one is rejected, existing workflows keep running, and `N8N_DEPRECATED_NODES_BLOCK=false` restores the old behaviour. The affected range reads "below 2.43.3, below 2.42.6, below 3.0.1" with no v1 line, and npm dates 2.42.6 and 2.43.3 to 2026-10-09 and 2.44.0 to 2026-10-13, so the block shipped nineteen days before the advisory. Administrators are told to review existing workflows and move them to the Code node. Interim: add the three types to `NODES_EXCLUDE`, or restrict workflow editing to fully trusted users.
- **GHSA-gx3v-3x3v-f8r5 — Insufficient Isolation in Workflow Expression Evaluation (7.7, High, AC:H).** An authenticated user who can create or modify workflows could escape the isolation around expression evaluation and run code on the n8n host. All three lines. Reporters NumberOreo1 and 0xNasu. Workarounds: trusted users only, remove `global:member` from untrusted users, audit active workflows for expressions that reference unexpected JavaScript properties, `NODES_EXCLUDE` and instance hardening.
- **GHSA-f2cw-9483-7vcp — Insecure GraphicsMagick Configuration (7.7, High, AT:P).** The GraphicsMagick bundled in n8n's official Docker image has known vulnerabilities in some components, and "processing untrusted images with the Edit Image node could lead to remote code execution on the n8n instance." All three lines. Reporters NumberOreo1 and 0xNasu. Interim: deactivate workflows that feed an unauthenticated Webhook node into Edit Image, restrict webhook endpoints at the network, remove the `url`, `svg`, `mvg`, `pcd` and `msl` coder modules if unused, or `NODES_EXCLUDE=n8n-nodes-base.editImage`.
- **GHSA-mx4r-96jx-v278 — Asana Trigger: Unauthenticated Request Can Reset Webhook Verification Secret (6.3).** The trigger accepted a new verification secret from any request carrying an `X-Hook-Secret` header, so anyone who knew the webhook URL could replace the secret and send forged Asana events that passed verification, after which genuine deliveries were rejected. Affected below 2.38.0 and below 3.0.1; fixed 2.38.0, so this one was fixed before the batch. Reporter Har1sh-k.
- **GHSA-jmcg-c7p5-q69g — NocoDB Node Sends Its API Token to Attacker-Chosen Hosts When Downloading Attachments (6.3).** With "Download Attachments" on, the node fetched attachment URLs taken from record content with the configured credential and never checked that the host matched the credential's own, so anyone who can write an attachment cell in the base receives the API token on the next run. All three lines. Reporter tr4ce-ju. The vendor's own step list includes rotating the token and setting `N8N_SSRF_PROTECTION_ENABLED=true`.
- **GHSA-prmc-fg87-r4gh — Credential-Using Nodes Forward Authentication Headers on Cross-Origin Redirects (6.3).** A helper defaulted `sendCredentialsOnCrossOriginRedirect` to true; the HTTP Request node v4.4 opted out, other credential-using nodes did not, so a redirect to another origin from an expression-built URL or an attacker-controlled endpoint carried the `Authorization` header and basic-auth credentials. All three lines. Workarounds: keep untrusted input out of request URLs, restrict outbound traffic, `N8N_SSRF_PROTECTION_ENABLED=true`, rotate credentials that may have reached an untrusted redirect target.
- **GHSA-pwj5-wwm6-g83j — Chat Trigger Embedded Chat Does Not Enforce n8n User Auth on All Requests (6.3).** The `setup` GET route was exempted from n8n User Auth in every chat mode, not only hosted chat, so on a published Chat Trigger in embedded mode an unauthenticated GET read a named session's conversation history or triggered the workflow with attacker-supplied input. All three lines. Reporter Masofgon.
- **GHSA-9qx8-fhxv-w794 — Browser Use Upload Tool Reads Arbitrary Files from the n8n Server (6.0, AT:P).** With `N8N_INSTANCE_AI_BROWSER_USE_ENABLED=true`, the `browser_upload` tool accepted absolute paths and handed them to Playwright, which read them on the n8n server because the browser session is remote; the approval prompt showed only the page host, never the path, so an authenticated member who connected their own browser session loaded any file the n8n process user can read, instance configuration included. Affected 2.45.x, 2.46.0 and the 3.0.0 line (no v1 line, the feature is newer). Reporter sm1ee.
- **GHSA-4v22-g448-h4rg — MongoDB Node Update Operations Can Modify Unintended Documents (5.3).** Update and Find And Replace did not validate the update key taken from incoming items, so untrusted input such as a webhook body could match and overwrite other documents or insert new ones. All three lines. Reporter Masofgon.
- **GHSA-rc3w-8jc8-7x3w — Open Redirect via MCP OAuth Dynamic Client Registration (5.1).** The MCP OAuth registration and authorization endpoints are on by default and need no authentication, so any caller could register a client with an arbitrary redirect URI and a crafted authorization URL sent a visitor there before the instance's checks ran; no tokens or session data travelled with the redirect. All three lines. Workaround: block unauthenticated access to `/mcp-oauth/register` and `/mcp-oauth/authorize` at the proxy.
- **GHSA-2x68-96jw-5r6c — SQL Injection via Metadata Filter Key in the Vector Store (OracleDB) Node (4.9).** Metadata Filter keys were not validated, so a workflow that passes webhook data into the filter key let an attacker read what the Oracle credential can read. Affected below 2.44.1, below 2.43.5 and below 3.0.1; fixed 2.43.5 and 2.44.1 (the October 14 fix versions), so this one was fixed two weeks before publication.
- **GHSA-426f-xmcv-g8pg — OAuth Account Hijack in the End-User Credential Connect Flow via Unauthenticated Callback (4.8, Enterprise).** The OAuth2 callback did not check that the browser completing a dynamic-credential connect flow belonged to the user who started it, so a member could send the provider authorization URL to someone else, and if that person consented without an n8n session their provider tokens were stored under the member's identity. Affected 2.45.x, 2.46.0 and the 3.0.0 line. Reporter sm1ee. Interim: `N8N_OAUTH_BROWSER_BINDING=true`.

Three of the twelve were fixed before the batch day and published with it (the deprecated-nodes block on 10-09 and 10-13, Asana at 2.38.0, OracleDB at 2.43.5 and 2.44.1); the other nine are fixed in today's three releases. The pattern is the one the September and October 14 files record, an instance as a credential hub and a lower-privileged member reaching code execution or another member's credential through a path the role model did not cover, with two additions this time: the sandbox the product runs user code in has a deprecated back door that was open by default until 10-09, and the image library in the official container is the kind of dependency `npm audit` never sees.

## Am I affected?

```bash
# Installed version; below 2.45.5 (stable) or 2.46.1 (beta) is affected by all twelve.
# The v1 line: 1.123.89 fixes seven (expression isolation, GraphicsMagick, NocoDB, cross-origin headers,
# Chat Trigger, MongoDB, MCP OAuth redirect); the deprecated-nodes 8.7, Browser Use, the Enterprise OAuth hijack,
# Asana and OracleDB list no v1 range. The advisories also list 3.0.1; npm has no 3.x release as of 2026-10-28.
npm ls -g n8n 2>/dev/null | grep n8n
docker ps --format '{{.Image}}' | grep n8n
npm view n8n dist-tags   # stable/latest 2.45.5, beta/next/rc 2.46.1 on 2026-10-28

# Workflows still using the three deprecated code nodes (they keep running after the block)
n8n export:workflow --all --output=/tmp/wf.json
grep -oE '"type": *"n8n-nodes-base\.(function|functionItem)"|"type": *"@n8n/n8n-nodes-langchain\.code"' /tmp/wf.json | sort | uniq -c

# The deprecated-node block turned off, or Browser Use turned on
env | grep -E '^N8N_DEPRECATED_NODES_BLOCK=false|^N8N_INSTANCE_AI_BROWSER_USE_ENABLED=true'

# Edit Image nodes fed by a webhook (GraphicsMagick), NocoDB nodes with attachment download
grep -c '"n8n-nodes-base.editImage"' /tmp/wf.json
grep -B2 -A6 '"n8n-nodes-base.nocoDb"' /tmp/wf.json | grep -i 'downloadAttachments'
```

For the credential paths, the audience is whoever could edit a NocoDB base's attachment cells, whoever could influence a redirect target reached by a credential-using node, and on Enterprise instances whoever a member could send a connect-flow URL to.

## If you are affected

Upgrade to 1.123.89, 2.45.5 or 2.46.1. Then move any Function, Function Item or LangChain Code node to the Code node, since the block keeps existing workflows running; rotate NocoDB API tokens where attachment download was on and the base had untrusted editors, and any credential whose node could have followed a cross-origin redirect; and on instances where Browser Use was enabled for members you do not fully trust, treat instance configuration (including the encryption key in `~/.n8n/config`) as read and rotate what it protects. [rotating cloud credentials](../playbooks/rotating-cloud-credentials.md) covers the provider side; [if your webapp was compromised](../playbooks/if-your-webapp-was-compromised.md) covers an instance where the expression or image path may have run attacker code.

## Prevention

- An n8n instance holds every credential its workflows use; membership is the control the vendor names first in all twelve advisories.
- Leave `N8N_DEPRECATED_NODES_BLOCK` at its default, and `NODES_EXCLUDE` the Edit Image, MongoDB and NocoDB nodes where unused.
- Put `/webhook/*`, `/mcp-oauth/*` and chat endpoints behind the proxy rules the batch keeps asking for, and set `N8N_SSRF_PROTECTION_ENABLED=true`.
- The container image is a dependency: rebuild on the vendor's tag, do not pin a digest for months.
- [credential-hygiene](../prevention/credential-hygiene.md), [agent-sandboxing](../prevention/agent-sandboxing.md) and [ci-cd-hardening](../prevention/ci-cd-hardening.md).


## Update 2026-10-30 — the deprecated-nodes advisory is CVE-2026-119408 (VulnCheck, 2026-10-30; 8.7 / 8.8), with a range that names the 10-09 block versions rather than the 10-28 releases

VulnCheck published CVE-2026-119408 for GHSA-9p7v-45m2-wxgj on 2026-10-30: "n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation." CVSS 4.0 8.7 and 3.1 8.8. Its `affected` entries are `< 2.42.6`, `2.43.0 to < 2.43.3` and `3.0.0 to < 3.0.1`, and its references are the vendor advisory, fix commit ea8417e2 and the `n8n@2.42.6` release tag.

Two things to read against the file above. First, the record's range follows the fix commit, so it names the versions where the block landed (2.42.6 and 2.43.3 on 2026-10-09 per the registry) and not the 10-28 releases the vendor advisory also lists; both are right, and the registry dates settle it: an instance on 2.42.6 or 2.43.3 has had the block since 10-09. Second, the record repeats the `3.0.1` line that npm does not carry (`npm view n8n versions` on 2026-10-30 still holds no 3.x), so the only installable fixed versions remain 2.42.6 and 2.43.3 (10-09), 2.44.0 (10-13, registry line in Sources) and the three 10-28 releases 1.123.89, 2.45.5 and 2.46.1. The record names no v1 line at all; the vendor advisory's `1.123.89` is the v1 fix and is on npm.

Sources for this update: [CVE Services — CVE-2026-119408](https://cveawg.mitre.org/api/cve/CVE-2026-119408) — fetched 2026-10-30: CNA VulnCheck, published 2026-10-30, the three ranges, both scores, the GHSA, commit and tag references; npm registry `n8n` `time`, queried 2026-10-30: 2.42.6 2026-10-09 07:30, 2.43.3 10-09 08:19, no 3.0.0 or 3.0.1, `latest` 2.45.7.

## Sources

- [n8n community — Security update — 28 October 2026](https://community.n8n.io/t/security-update-28-october-2026/325135) — fetched 2026-10-28: The n8n Security Team, 09:18, twelve advisories (3 High, 9 Medium) with links, fixed versions v1.123.89, v3.0.1, v2.46.1 (beta), v2.45.5 (stable), cloud patched automatically.
- [n8n-io/n8n security advisories, page 1](https://github.com/n8n-io/n8n/security/advisories) and [page 2](https://github.com/n8n-io/n8n/security/advisories?page=2) — walked 2026-10-28: ten rows dated 10-28 on page 1, two on page 2, then the 10-14 batch.
- [GHSA-9p7v-45m2-wxgj — Deprecated Code Nodes Allow Code Execution in the n8n Main Process](https://github.com/n8n-io/n8n/security/advisories/GHSA-9p7v-45m2-wxgj) — fetched 2026-10-28: High 8.7, vector, affected and patched lines, the default block and `N8N_DEPRECATED_NODES_BLOCK`, workarounds.
- [GHSA-gx3v-3x3v-f8r5 — Insufficient Isolation in Workflow Expression Evaluation](https://github.com/n8n-io/n8n/security/advisories/GHSA-gx3v-3x3v-f8r5) — fetched 2026-10-28: High 7.7, vector, lines, workarounds, reporters.
- [GHSA-f2cw-9483-7vcp — Insecure GraphicsMagick Configuration](https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cw-9483-7vcp) — fetched 2026-10-28: High 7.7, the Docker-image statement, the Edit Image sentence quoted above, coder-module and `NODES_EXCLUDE` workarounds, reporters.
- [GHSA-9qx8-fhxv-w794 — Browser Use Upload Tool Reads Arbitrary Files from the n8n Server](https://github.com/n8n-io/n8n/security/advisories/GHSA-9qx8-fhxv-w794) — fetched 2026-10-28: 6.0, the feature flag, the Playwright path, reporter.
- [GHSA-rc3w-8jc8-7x3w — Open Redirect via MCP OAuth Dynamic Client Registration](https://github.com/n8n-io/n8n/security/advisories/GHSA-rc3w-8jc8-7x3w) — fetched 2026-10-28: 5.1, the endpoints, workarounds.
- [GHSA-426f-xmcv-g8pg — OAuth Account Hijack in the End-User Credential Connect Flow](https://github.com/n8n-io/n8n/security/advisories/GHSA-426f-xmcv-g8pg) — fetched 2026-10-28: 4.8, Enterprise scope, `N8N_OAUTH_BROWSER_BINDING`, reporter.
- [GHSA-prmc-fg87-r4gh — Credential-Using Nodes Forward Authentication Headers on Cross-Origin Redirects](https://github.com/n8n-io/n8n/security/advisories/GHSA-prmc-fg87-r4gh) — fetched 2026-10-28: 6.3, the helper default, the HTTP Request v4.4 exception, workarounds.
- [GHSA-pwj5-wwm6-g83j — Chat Trigger Embedded Chat Does Not Enforce n8n User Auth on All Requests](https://github.com/n8n-io/n8n/security/advisories/GHSA-pwj5-wwm6-g83j) — fetched 2026-10-28: 6.3, the `setup` route, reporter.
- [GHSA-jmcg-c7p5-q69g — NocoDB Node Sends Its API Token to Attacker-Chosen Hosts](https://github.com/n8n-io/n8n/security/advisories/GHSA-jmcg-c7p5-q69g) — fetched 2026-10-28: 6.3, mechanism, rotation step, reporter.
- [GHSA-2x68-96jw-5r6c — SQL Injection via Metadata Filter Key in the Vector Store (OracleDB) Node](https://github.com/n8n-io/n8n/security/advisories/GHSA-2x68-96jw-5r6c) — fetched 2026-10-28: 4.9, affected below 2.44.1 / 2.43.5 / 3.0.1.
- [GHSA-mx4r-96jx-v278 — Asana Trigger: Unauthenticated Request Can Reset Webhook Verification Secret](https://github.com/n8n-io/n8n/security/advisories/GHSA-mx4r-96jx-v278) — fetched 2026-10-28: 6.3, fixed 2.38.0, reporter.
- [GHSA-4v22-g448-h4rg — MongoDB Node Update Operations Can Modify Unintended Documents](https://github.com/n8n-io/n8n/security/advisories/GHSA-4v22-g448-h4rg) — fetched 2026-10-28: 5.3, lines, reporter.
- npm registry, `npm view n8n time` and `dist-tags`, queried 2026-10-28: 2.42.6 2026-10-09 07:30, 2.43.3 10-09 08:19, 2.44.0 10-13 07:46, 1.123.89 10-28 07:18, 2.45.5 10-28 07:22, 2.46.1 10-28 07:25; no 3.x version in the 1,226-version list; `n8n@3.0.1` returns E404.