Threats tagged 'ghsa-rvxx-r8h9-hc4w'

n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 have an OData $filter injection vulnerability in Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes. This flaw allows attackers to inject single quotes into expression-bindable parameters, potentially exposing the entire contact list or redirecting SharePoint writes to unintended list items within the scope of stored credentials.