Topic

Cve 2026 119978

Coverage tagged cve 2026 119978.

Articles: 1
Desk: 1

Data graphic: Flowise CVE-2026-119978 CVSS 4.0 9.0, through 3.1.4, needs ALLOW_BUILTIN_DEP=true has no fix, while n8n CVE-2026-119408 CVSS 4.0 8.7 is fixed in 2.42.6, 2.43.3 and 3.0.1. Both need an authenticated user.

highAI Security Cve 2026 119978

Flowise and n8n Code Nodes Escape Their Sandboxes to Run OS Commands, and Flowise Has No Fix

Authenticated users can escape Flowise and n8n code nodes to run OS commands. n8n is fixed in 2.42.6, 2.43.3 and 3.0.1; Flowise 3.1.4 has no fix and is archived.

Nov 5 · 5 min