CVE-2026-44792: n8n SQL injection in Source Control via Data Table JSON

Executive brief

n8n, a popular workflow automation tool, is vulnerable to a security flaw in its Source Control feature. An attacker who can modify the connected Git repository can inject malicious code that executes when an administrator pulls updates. This could allow the attacker to gain unauthorized access to the internal database, potentially leading to data theft or full system compromise.

Technical details

A SQL injection vulnerability exists in n8n's Source Control feature due to improper neutralization of special elements in Data Table JSON files. An attacker with write access to the connected Git repository can commit a crafted JSON file with a malicious column name. When an administrator triggers a 'Source Control Pull', the application imports the file and executes the injected SQL against the internal PostgreSQL backend. This requires the instance to be using PostgreSQL and the Source Control feature to be active. The issue is fixed in versions 1.123.43, 2.20.7, and 2.21.1.

Affected products

• n8n-io n8n < 1.123.43, >= 2.0.0-rc.0, < 2.20.7, >= 2.21.0, < 2.21.1

Timeline

• 2026-05-13: disclosed
• 2026-05-14: advisory

References

• https://api.github.com/users/sm1ee
• https://github.com/sm1ee
• https://api.github.com/users/sm1ee/gists%7B/gist_id%7D
• https://api.github.com/users/sm1ee/repos
• https://avatars.githubusercontent.com/u/19336661?v=4
• https://api.github.com/users/sm1ee/events%7B/privacy%7D