EUVD-2026-27098
GHSA-mp4j-h6gh-f6mp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionGitHub Advisory
Impact
A flaw in the SeaTable node's row:search and row:get operations allowed user-controlled input to be concatenated directly into SQL query strings without escaping or parameterization. In workflows where external user input is passed via expressions into the SeaTable node's search or row retrieval parameters, an attacker could manipulate the constructed query to retrieve unintended rows from the connected SeaTable base, bypassing row-level filtering logic implemented in the workflow.
Exploitation requires a specific workflow configuration:
- The SeaTable node must be used with user-controlled input passed via expressions (e.g., from a form or webhook) into the
searchTermorrowIdparameters.
Patches
The issue has been fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Limit workflow creation and editing permissions to fully trusted users only.
- Disable the SeaTable node by adding
n8n-nodes-base.seaTableto theNODES_EXCLUDEenvironment variable. - Avoid passing unvalidated external user input into SeaTable node search or row retrieval parameters via expressions.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
AnalysisAI
SQL injection in n8n's SeaTable node allows remote unauthenticated attackers to bypass row-level access controls and retrieve unintended data from SeaTable databases when workflows accept user-controlled input via expressions in search or row retrieval parameters. The vulnerability affects n8n versions before 1.123.32, 2.17.4, and 2.18.1, and requires specific workflow configuration combining the SeaTable node with external user input passed through expressions. No public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
The SeaTable node in n8n (an open-source workflow automation platform) implements database query operations (row:search and row:get) by concatenating user input directly into SQL query strings without parameterized queries or escaping (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). The vulnerable code path occurs when expressions containing external input from webhooks, forms, or API calls are evaluated and passed to the SeaTable connector's searchTerm or rowId parameters. SeaTable is a spreadsheet-like database system, and the node provides abstraction for querying it. The root cause is the absence of prepared statements or parameter binding at the point where user-controlled expressions are resolved into SQL query components.
RemediationAI
Upgrade n8n to version 1.123.32 (for 1.x branches), 2.17.4 (for 2.0-2.17 branches), or 2.18.1 (for 2.18+ branches) to apply vendor-released patches that implement parameterized queries in the SeaTable node. If immediate upgrade is not feasible, apply these temporary mitigations in order of effectiveness: (1) Disable the SeaTable node entirely by adding n8n-nodes-base.seaTable to the NODES_EXCLUDE environment variable - this eliminates the attack surface at the cost of losing SeaTable functionality until patched; (2) Restrict workflow creation and editing permissions to fully trusted administrators only, preventing attackers from crafting malicious workflows even if they gain access to n8n; (3) Enforce strict input validation in workflows that use the SeaTable node - before passing any external input (from webhooks, forms, API calls) to the searchTerm or rowId parameters, validate against a whitelist of expected values or use expression functions to sanitize input (note: this mitigation is error-prone and does not substitute for patching). All workarounds are temporary and should be replaced with patched versions as soon as operationally feasible. See https://github.com/n8n-io/n8n/security/advisories/GHSA-mp4j-h6gh-f6mp for vendor advisory details.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today