Executive brief
n8n is a workflow automation platform that allows users to connect applications and automate tasks. The Snowflake integration node's executeQuery operation was vulnerable to SQL injection because it directly inserted user-provided expression values into SQL queries without parameterization. An attacker who can create or modify workflows could inject malicious SQL to read or modify database data, but exploitation requires the workflow author to have already embedded untrusted data directly in the query.
Technical details
This is a SQL injection vulnerability (CWE-89) in n8n's Snowflake node executeQuery operation, caused by unparameterized expression interpolation. The vulnerable component directly interpolates expression values into raw SQL query strings rather than using bound parameters. Attack vector is network-based with low attack complexity; exploitation requires low privileges (a workflow author account) and no user interaction, though it does require a prior condition: that untrusted data has already been embedded directly in the query. An attacker with workflow creation permissions can craft workflows that inject arbitrary SQL commands to exfiltrate or modify data. The vulnerability was patched in versions 1.123.67, 2.31.5, and 2.32.1, which introduced an optional "Query Parameters" field for safe parameter binding.
Affected products
- n8n n8n < 1.123.67, < 2.31.5, < 2.32.1
Timeline
- 2026-07-22: disclosed: GHSA advisory published
- 2026-07-22: patched: Fixed in versions 1.123.67, 2.31.5, and 2.32.1