n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
The n8n Snowflake node's Execute Query operation was vulnerable to SQL injection due to direct interpolation of expression values into SQL strings without parameterization. This vulnerability affects workflows that embed untrusted expression data directly in raw SQL queries. The issue is fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1 by introducing a parameter binding feature. Temporary mitigations include restricting workflow editing to trusted users and auditing existing workflows for unsafe query usage.
AI Analysis
Technical Summary
The n8n Snowflake node's Execute Query operation allowed SQL injection because it interpolated expression values directly into SQL query strings without parameterization. Exploitation requires that a workflow author has embedded untrusted data directly into raw SQL queries. The vulnerability is addressed in n8n versions 1.123.67, 2.31.5, and 2.32.1 by adding an optional 'Query Parameters' field that supports safe parameter binding. Until upgrading, administrators should restrict workflow creation/editing permissions, audit workflows for unsafe queries, and limit network access to endpoints feeding data into vulnerable nodes.
Potential Impact
Successful exploitation could allow an attacker to perform SQL injection attacks via untrusted data embedded in raw SQL queries within n8n workflows using the Snowflake node. This could lead to unauthorized data access or manipulation in Snowflake databases. However, exploitation requires prior embedding of untrusted data in queries by a workflow author, limiting attack scope.
Mitigation Recommendations
A fix is available in n8n versions 1.123.67, 2.31.5, and 2.32.1 or later. Users should upgrade to these versions to remediate the vulnerability. Until upgrading, restrict workflow creation and editing permissions to trusted users only, audit existing workflows for unsafe usage of the Snowflake executeQuery operation, and restrict network access to webhook or trigger endpoints that provide data to these nodes. These mitigations reduce risk but do not fully eliminate it.
n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
Description
The n8n Snowflake node's Execute Query operation was vulnerable to SQL injection due to direct interpolation of expression values into SQL strings without parameterization. This vulnerability affects workflows that embed untrusted expression data directly in raw SQL queries. The issue is fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1 by introducing a parameter binding feature. Temporary mitigations include restricting workflow editing to trusted users and auditing existing workflows for unsafe query usage.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The n8n Snowflake node's Execute Query operation allowed SQL injection because it interpolated expression values directly into SQL query strings without parameterization. Exploitation requires that a workflow author has embedded untrusted data directly into raw SQL queries. The vulnerability is addressed in n8n versions 1.123.67, 2.31.5, and 2.32.1 by adding an optional 'Query Parameters' field that supports safe parameter binding. Until upgrading, administrators should restrict workflow creation/editing permissions, audit workflows for unsafe queries, and limit network access to endpoints feeding data into vulnerable nodes.
Potential Impact
Successful exploitation could allow an attacker to perform SQL injection attacks via untrusted data embedded in raw SQL queries within n8n workflows using the Snowflake node. This could lead to unauthorized data access or manipulation in Snowflake databases. However, exploitation requires prior embedding of untrusted data in queries by a workflow author, limiting attack scope.
Mitigation Recommendations
A fix is available in n8n versions 1.123.67, 2.31.5, and 2.32.1 or later. Users should upgrade to these versions to remediate the vulnerability. Until upgrading, restrict workflow creation and editing permissions to trusted users only, audit existing workflows for unsafe usage of the Snowflake executeQuery operation, and restrict network access to webhook or trigger endpoints that provide data to these nodes. These mitigations reduce risk but do not fully eliminate it.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-652q-gvq3-74qv
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a616bcb9c2644c7f80dbc17
Added to database: 07/23/2026, 01:18:03 UTC
Last enriched: 07/23/2026, 01:24:27 UTC
Last updated: 07/23/2026, 02:02:09 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.