AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-58qr-rcgv-642v: n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode

criticalvulnerability

security

Source: GitHub Advisory DatabaseMarch 25, 2026CVE-2026-33660

Summary

n8n, a workflow automation tool, has a security flaw in its Merge node's SQL mode that allows authenticated users to read files from the server and execute arbitrary code (remote code execution, where an attacker can run commands on a system they don't own). The vulnerability exists because the AlaSQL sandbox (a restricted environment meant to safely run SQL code) did not properly block certain dangerous SQL statements.

Solution / Mitigation

The issue has been fixed in n8n versions 2.14.1, 2.13.3, and 1.123.27. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators can: (1) limit workflow creation and editing permissions to fully trusted users only, or (2) disable the Merge node by adding `n8n-nodes-base.merge` to the `NODES_EXCLUDE` environment variable. Note: these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.