n8n SQL Injection Vulnerability in MySQL v1 Node's executeQuery Operation

A SQL injection vulnerability has been identified in n8n versions prior to 1.123.61, 2.x prior to 2.27.4, and 2.28.x prior to 2.28.1. The issue arises in the legacy MySQL v1 node's executeQuery operation, where evaluated expression values are directly inserted into the SQL string without proper parameterization. This flaw allows attacker-controlled input to manipulate the SQL query, executing arbitrary SQL commands with the privileges of the MySQL credentials used in the workflow. The vulnerability is exploitable when the workflow is connected to an externally reachable trigger, such as a Webhook node. Notably, the MySQL v2 node is not affected, as it employs parameterized queries.

Impact

Exploitation of this vulnerability allows for arbitrary SQL execution with the privileges of the configured MySQL credentials, potentially leading to unauthorized data disclosure, modification, or deletion in the affected database.

Remediation

Users can upgrade to n8n versions 1.123.61, 2.27.4, or 2.28.1 to address this vulnerability. If an immediate upgrade is not possible, the MySQL v1 node can be disabled or access to affected workflows can be restricted. Alternatively, workflows can be migrated to use the MySQL v2 node, which is not vulnerable.