n8n versions before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contain a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. This vulnerability arises because the operation directly substitutes evaluated expressions into SQL queries without parameterization. If an externally reachable trigger such as a Webhook node passes attacker-controlled input to these expressions, it can lead to arbitrary SQL execution with the privileges of the configured MySQL credentials. The newer MySQL v2 node, which uses parameterized queries, is not affected.