The n8n open source workflow automation platform contained an SQL injection vulnerability (CWE-89) in its Snowflake and legacy MySQL v1 nodes. These nodes constructed SQL queries by directly embedding user-controlled table names, column names, and update keys without proper identifier escaping, enabling injection attacks against the connected databases. This vulnerability affected versions prior to 1.123.32, 2.17.4, and 2.18.1. The issue was patched in these versions. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity). The product is a cloud service, so the vendor typically applies patches server-side.

Successful exploitation could allow an attacker with limited privileges to perform SQL injection attacks on the connected database through the affected nodes, potentially leading to unauthorized data access or manipulation. However, the impact is limited by the requirement for some privileges and the absence of known active exploits.

A fix is available in n8n versions 1.123.32, 2.17.4, and 2.18.1. Since n8n is a cloud-hosted service, the vendor manages remediation for the cloud environment. Users should ensure they are running these patched versions or verify with the vendor that the cloud service is updated. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.