8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-f3f2-mcxc-pwjx

GHSA-f3f2-mcxc-pwjx: n8n: SQL Injection in MySQL, PostgreSQL, and Microsoft SQL nodes

Impact

An authenticated user with permission to create or modify workflows and access to a database credential could unknowingly create a workflow that was vulnerable to SQL injection, even while expecting inputs to be handled safely through escaped parameters. By supplying specially crafted table or column names, an attacker could inject arbitrary SQL because the MySQL, PostgreSQL, and Microsoft SQL nodes did not escape identifier values when constructing queries, enabling injection through node configuration parameters.

Patches

The issue has been fixed in n8n version 2.4.0. Users should upgrade to this version or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

Limit workflow creation and editing permissions to fully trusted users only.
Disable the MySQL, PostgreSQL, and Microsoft SQL nodes by adding n8n-nodes-base.mySql, n8n-nodes-base.postgres, and n8n-nodes-base.microsoftSql to the NODES_EXCLUDE environment variable.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Credit

Reporter: Pawel Bednarz from the NATO Cyber Security Centre (NCSC)

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-f3f2-mcxc-pwjx

GHSA-f3f2-mcxc-pwjx:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	< 2.4.0	2.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because several database node functions in n8n constructed SQL queries by concatenating user-provided input without proper sanitization or validation. This allowed authenticated users with workflow creation permissions to perform SQL injection attacks.

The analysis of the patch commit f73fae6fe7fc34907bba102648a9997186aa4385 reveals two main classes of issues:

Improper Identifier Escaping: In the Microsoft SQL node (GenericFunctions.ts), functions like formatColumns, updateOperation, and deleteOperation were building queries with unescaped column and table names. An attacker could provide a malicious identifier like column_name] FROM users; -- to terminate the intended query and inject a new one.
Lack of Operator and Value Validation: In the MySQL and PostgreSQL nodes (v2), the execute functions for select and delete operations accepted where clauses directly from user input. The operators within these clauses were not validated against a strict allowlist, enabling an attacker to inject SQL through the condition field (e.g., =1; SELECT pg_sleep(10); --). Additionally, the addSortRules function for MySQL and the select operation's LIMIT clause for PostgreSQL were also found to be vulnerable to injection as they directly concatenated user input into the query.

The patch remediates these issues by:

Introducing a robust escapeIdentifier function for Microsoft SQL to handle special characters in table and column names.
Implementing a getWhereClauses utility function for MySQL and PostgreSQL that validates all parts of a where clause, including ensuring the operator is from a predefined safe list.
Enforcing that the ORDER BY direction is strictly ASC or DESC.
Using parameterized queries for values like the LIMIT clause.

Vulnerable functions

formatColumns

packages/nodes-base/nodes/Microsoft/Sql/GenericFunctions.ts

The function was vulnerable to SQL injection because it did not properly escape column identifiers, allowing an attacker to inject arbitrary SQL through specially crafted column names.

updateOperation

packages/nodes-base/nodes/Microsoft/Sql/GenericFunctions.ts

The function constructed an UPDATE query without escaping the `updateKey` or the column names in the SET clause. This allowed for SQL injection if an attacker could control these values.

deleteOperation

packages/nodes-base/nodes/Microsoft/Sql/GenericFunctions.ts

The function was vulnerable to SQL injection because it constructed a DELETE query without escaping the `deleteKey` used in the WHERE clause.

addSortRules

packages/nodes-base/nodes/MySql/v2/helpers/utils.ts

The function was vulnerable to SQL injection in the ORDER BY clause. It used the `rule.direction` value directly in the query without validation, allowing an attacker to inject arbitrary SQL by providing a malicious direction.

execute

packages/nodes-base/nodes/MySql/v2/actions/database/deleteTable.operation.ts

The function was vulnerable to SQL injection because it retrieved `where` clauses from user input and used them to construct a query without validating the operators. The patch introduces `getWhereClauses` to perform this validation.

execute

packages/nodes-base/nodes/MySql/v2/actions/database/select.operation.ts

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.2

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-f3f2-mcxc-pwjx: n8n: SQL Injection in MySQL, PostgreSQL, and Microsoft SQL nodes

Impact

Patches

Workarounds

Credit

GHSA-f3f2-mcxc-pwjx:

8.2

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

GHSA-f3f2-mcxc-pwjx: n8n: SQL Injection in MySQL, PostgreSQL, and Microsoft SQL nodes

Impact

Patches

Workarounds

Credit

Technical Details

8.2

8.2

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI