N8n: Duplicate Advisory: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
n8n versions before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contain a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. This vulnerability arises because the operation directly substitutes evaluated expressions into SQL queries without parameterization. If an externally reachable trigger such as a Webhook node passes attacker-controlled input to these expressions, it can lead to arbitrary SQL execution with the privileges of the configured MySQL credentials. The newer MySQL v2 node, which uses parameterized queries, is not affected.
AI Analysis
Technical Summary
The legacy MySQL v1 node in n8n prior to versions 1.123.61, 2.27.4, and 2.28.1 allows SQL injection via unparameterized expression interpolation in the executeQuery operation. This occurs because the node substitutes evaluated {{ ... }} expressions directly into raw SQL strings without using parameterized queries. When workflows use this node with expression-sourced values and are triggered by externally reachable inputs (e.g., Webhook nodes), attacker-controlled data can reach these expressions, enabling execution of arbitrary SQL commands with the privileges of the MySQL credentials configured in n8n. The MySQL v2 node is not affected as it uses parameterized queries.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary SQL commands on the connected MySQL database with the privileges of the configured MySQL user. This can lead to data disclosure, modification, or deletion depending on the database permissions. The vulnerability requires that the attacker can influence expression values in workflows triggered by externally reachable nodes, such as Webhooks.
Mitigation Recommendations
A fix is available in n8n versions 1.123.61, 2.27.4, and 2.28.1 and later. Users should upgrade to these or newer versions to remediate the vulnerability. Additionally, workflows should migrate from the legacy MySQL v1 node to the MySQL v2 node, which uses parameterized queries and is not affected by this issue.
N8n: Duplicate Advisory: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
Description
n8n versions before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contain a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. This vulnerability arises because the operation directly substitutes evaluated expressions into SQL queries without parameterization. If an externally reachable trigger such as a Webhook node passes attacker-controlled input to these expressions, it can lead to arbitrary SQL execution with the privileges of the configured MySQL credentials. The newer MySQL v2 node, which uses parameterized queries, is not affected.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The legacy MySQL v1 node in n8n prior to versions 1.123.61, 2.27.4, and 2.28.1 allows SQL injection via unparameterized expression interpolation in the executeQuery operation. This occurs because the node substitutes evaluated {{ ... }} expressions directly into raw SQL strings without using parameterized queries. When workflows use this node with expression-sourced values and are triggered by externally reachable inputs (e.g., Webhook nodes), attacker-controlled data can reach these expressions, enabling execution of arbitrary SQL commands with the privileges of the MySQL credentials configured in n8n. The MySQL v2 node is not affected as it uses parameterized queries.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary SQL commands on the connected MySQL database with the privileges of the configured MySQL user. This can lead to data disclosure, modification, or deletion depending on the database permissions. The vulnerability requires that the attacker can influence expression values in workflows triggered by externally reachable nodes, such as Webhooks.
Mitigation Recommendations
A fix is available in n8n versions 1.123.61, 2.27.4, and 2.28.1 and later. Users should upgrade to these or newer versions to remediate the vulnerability. Additionally, workflows should migrate from the legacy MySQL v1 node to the MySQL v2 node, which uses parameterized queries and is not affected by this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2qp2-6frj-p9pq
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a6150ca9c2644c7f8da00a9
Added to database: 07/22/2026, 23:22:50 UTC
Last enriched: 07/22/2026, 23:26:09 UTC
Last updated: 07/31/2026, 19:24:51 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.