Executive brief
n8n is a workflow automation platform that allows users to create and run automated processes. An authenticated user with permission to create or modify workflows can exploit a flaw in the Merge node's SQL query mode to execute arbitrary code and write arbitrary files on the n8n server, potentially compromising the entire system and all data it processes.
Technical details
The vulnerability exists in n8n's Merge node, which supports SQL query mode. An authenticated attacker with workflow creation/modification permissions can inject malicious code through the SQL query functionality, leading to arbitrary code execution (CWE-89, CWE-94). The attack requires valid credentials and workflow permissions but no user interaction. Successful exploitation allows an attacker to execute arbitrary code and write files on the server, achieving full system compromise. Patches are available in versions 1.123.22, 2.9.3, and 2.10.1; administrators can temporarily restrict workflow permissions or disable the Merge node via NODES_EXCLUDE environment variable.
Affected products
- n8n n8n All versions prior to 1.123.22; 2.0.0 through 2.9.2; 2.10.0
Timeline
- 2026-02-25: disclosed: GHSA-wxx7-mcgf-j869 published
- 2026-02-25: patched: Patches released in versions 1.123.22, 2.9.3, and 2.10.1