CyberRota Analysis
AI-GeneratedThe Supabase node in n8n versions prior to 1.123.80 and from 2.0.0 before 2.39.6, as well as from 2.40.0 before 2.40.1, is vulnerable to a critical filter injection flaw that allows attackers to manipulate unescaped field values. This vulnerability can be exploited to read, update, or delete all records in a database table through a single request. Organizations using affected versions of n8n should prioritize immediate remediation to mitigate potential data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or delete entire tables in a single request.