{"data":{"id":"d6c286a6-0173-4fdf-8181-adb2b584d3db","title":"GHSA-hwmj-qg4v-cvg9: n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation","summary":"n8n's legacy MySQL v1 node has a SQL injection vulnerability (a type of attack where malicious SQL code is inserted into a query) in its executeQuery operation because it directly inserts user input into SQL queries without parameterization (a safer method that treats input as data, not code). If a workflow receives input from an external source like a webhook and uses that input in a MySQL v1 query, an attacker could execute arbitrary SQL commands and access or modify the database.","solution":"The issue has been fixed in n8n versions 1.123.61, 2.27.4, and 2.28.1. Users should upgrade to one of these versions or later. If upgrading is not immediately possible, administrators can disable the MySQL node by adding `n8n-nodes-base.mySql` to the `NODES_EXCLUDE` environment variable, restrict access to workflows using the MySQL v1 node with the executeQuery operation, ensure webhook endpoints require authentication, or migrate affected workflows to use the MySQL v2 node which uses parameterized queries. These workarounds do not fully remediate the risk and should only be used as short-term measures.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-hwmj-qg4v-cvg9","publishedAt":"2026-07-22T22:22:22.000Z","cveId":"CVE-2026-59257","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["n8n@>= 2.0.0-rc.0, < 2.27.4 (fixed: 2.27.4)","n8n@>= 2.28.0, < 2.28.1 (fixed: 2.28.1)","n8n@< 1.123.61 (fixed: 1.123.61)"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["n8n"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00314,"patchAvailable":true,"disclosureDate":"2026-07-22T22:22:22.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.75,"researchCategory":null,"atlasIds":["AML.T0010"]}}