{"data":{"id":"32e908bd-fc96-4f56-8eb9-5e9802b9874d","title":"GHSA-jqwr-vx3p-r266: n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances","summary":"The PostgresTrigger node in n8n had a SQL injection vulnerability (a type of attack where an attacker tricks an application into running unintended database commands) that allowed authenticated users to execute arbitrary SQL commands on connected PostgreSQL databases. An attacker could exploit this to read or modify all data in the database.","solution":"The issue has been fixed in n8n versions 1.123.67, 2.31.5 and 2.32.1. Users should upgrade to these versions or later. If upgrading is not immediately possible, temporary mitigations include: restricting n8n instance access to fully trusted users only, disabling the PostgresTrigger node by adding `n8n-nodes-base.postgresTrigger` to the `NODES_EXCLUDE` environment variable, and ensuring PostgreSQL credentials are configured with minimum required privileges and do not use SUPERUSER roles. The source notes these workarounds do not fully remediate the risk and should only be used as short-term measures.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-jqwr-vx3p-r266","publishedAt":"2026-07-22T23:20:03.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["n8n@>= 2.0.0-rc.0, < 2.31.5 (fixed: 2.31.5)","n8n@>= 2.32.0, < 2.32.1 (fixed: 2.32.1)","n8n@< 1.123.67 (fixed: 1.123.67)"],"affectedVendors":[],"affectedVendorsRaw":["n8n"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":true,"disclosureDate":"2026-07-22T23:20:03.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":null}}