Jubke

A SQL injection issue exists in the legacy MySQL v1 node during the `executeQuery` operation. The system substitutes evaluated `{{ ... }}` expression values directly into the raw SQL string without using parameterization. If a workflow utilizes this operation with expression-sourced values and is linked to an externally-reachable trigger, such as a Webhook node, an attacker can provide malicious input to execute arbitrary SQL commands using the privileges of the configured MySQL credentials.

The Compression node's Decompress operation expands attacker-controlled archives into memory without enforcing limits on the decompressed output size. An unauthenticated attacker can send a small compressed archive to a public webhook workflow utilizing this node, leading to memory exhaustion. This causes the n8n process to terminate, which disrupts all workflows running within the same instance.

An open source workflow automation platform contains an issue where the Snowflake node and the legacy MySQL v1 node construct SQL queries by directly interpolating user-controlled table names, column names, and update keys into query strings without identifier escaping. This allows for SQL injection against the connected database.