CVE-2026-42237

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

8.2 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H                                    

Vulnerability Description

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the fix for GHSA-f3f2-mcxc-pwjx did not cover the Snowflake node or the legacy MySQL v1 node. Both nodes construct SQL queries by directly interpolating user-controlled table names, column names, and update keys into query strings without identifier escaping, enabling SQL injection against the connected database. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

Vulnerability Details

Published Date

April 29, 2026

Last Modified

May 06, 2026

CWE ID

CWE-89

Source

GitHub

Vendor

npm

Product

n8n

External References

https://github.com/n8n-io/n8n/security/advisories/GHSA-f3f2-mcxc-pwjx
https://github.com/n8n-io/n8n/security/advisories/GHSA-hp3c-vfpm-q4f7
https://github.com/advisories/GHSA-hp3c-vfpm-q4f7

CVE-2026-42237

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment