AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-hwmj-qg4v-cvg9: n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

mediumvulnerability

security

Source: GitHub Advisory DatabaseJuly 22, 2026CVE-2026-59257

Summary

n8n's legacy MySQL v1 node has a SQL injection vulnerability (a type of attack where malicious SQL code is inserted into a query) in its executeQuery operation because it directly inserts user input into SQL queries without parameterization (a safer method that treats input as data, not code). If a workflow receives input from an external source like a webhook and uses that input in a MySQL v1 query, an attacker could execute arbitrary SQL commands and access or modify the database.

Solution / Mitigation

The issue has been fixed in n8n versions 1.123.61, 2.27.4, and 2.28.1. Users should upgrade to one of these versions or later. If upgrading is not immediately possible, administrators can disable the MySQL node by adding `n8n-nodes-base.mySql` to the `NODES_EXCLUDE` environment variable, restrict access to workflows using the MySQL v1 node with the executeQuery operation, ensure webhook endpoints require authentication, or migrate affected workflows to use the MySQL v2 node which uses parameterized queries. These workarounds do not fully remediate the risk and should only be used as short-term measures.