AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-mp4j-h6gh-f6mp: n8n has SQL Injection in SeaTable Node

mediumvulnerability

security

Source: GitHub Advisory DatabaseApril 29, 2026CVE-2026-42229

Summary

A SQL injection (inserting malicious code into database queries) flaw in n8n's SeaTable node allowed attackers to manipulate search and row retrieval operations when user-controlled input was passed into the node without proper safeguards, potentially exposing unintended database rows. The vulnerability required a specific workflow setup where external input from sources like forms or webhooks was directly used in search parameters.

Solution / Mitigation

The issue has been fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1. Users should upgrade to one of these versions or later. If upgrading is not immediately possible, temporary mitigations include: restricting workflow creation and editing permissions to trusted users only; disabling the SeaTable node by adding `n8n-nodes-base.seaTable` to the `NODES_EXCLUDE` environment variable; and avoiding unvalidated external user input in SeaTable node parameters.