CyberRota Analysis
AI-GeneratedThe legacy MySQL v1 node in n8n versions prior to 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 is vulnerable to SQL injection due to the direct substitution of evaluated expression values into raw SQL strings without proper parameterization. This vulnerability can be exploited when workflows are triggered by external sources, allowing attackers to execute arbitrary SQL commands with the privileges of the configured MySQL credentials. Organizations using affected versions of n8n, especially those with publicly accessible workflows, should prioritize patching to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated {{ ... }} expression values directly into the raw SQL string without parameterization. When a workflow uses this operation with expression-sourced values and is connected to an externally-reachable trigger (such as a Webhook node), attacker-controlled input reaching those expressions results in SQL injection, allowing execution of arbitrary SQL with the configured MySQL credentials' privileges. The MySQL v2 node, which uses parameterized queries, is not affected.
Related CVEs
Other vulnerabilities affecting the same vendor(s)