The n8n Postgres Trigger node suffers from a SQL injection vulnerability (CWE-89) due to improper escaping of user-supplied identifier parameters (channel, function, and trigger names) in SQL statements. Authenticated users can exploit this to execute arbitrary SQL commands on the connected PostgreSQL database with the privileges of the configured credentials, resulting in full read and write access. The vulnerability affects versions <1.123.67 and >=2.32.0 <2.32.1. Official fixes are available in versions 1.123.67, 2.31.5, and 2.32.1. Temporary mitigations include restricting access, disabling the vulnerable node, and using least-privilege credentials.

Successful exploitation allows an authenticated user to execute arbitrary SQL commands on the connected PostgreSQL database with the privileges of the configured credentials. This grants full read and write access to the database, potentially compromising data confidentiality and integrity.

A fix is available in n8n versions 1.123.67, 2.31.5, and 2.32.1 or later. Users should upgrade to these versions to remediate the vulnerability. If immediate upgrade is not possible, temporary mitigations include restricting n8n instance access to fully trusted users, disabling the PostgresTrigger node via the NODES_EXCLUDE environment variable, and ensuring PostgreSQL credentials have minimum required privileges without SUPERUSER roles. These mitigations do not fully remediate the risk and should only be used short-term.