{"schema":"threatline.record/2","record":{"id":"GHSA-mgpr-56r4-5c67","aliases":["GHSA-mgpr-56r4-5c67"],"summary":"OData $filter Injection in Microsoft Outlook and SharePoint v1 Nodes","details":"## Impact\r\n\r\nThe Microsoft Outlook contact lookup and the Microsoft SharePoint v1 item update build an OData $filter string literal from an expression-bindable parameter without escaping it. A single quote in the value closes the literal and rewrites the query. Where a workflow binds untrusted input into those fields, the Outlook lookup returns the bound mailbox's entire contact list instead of one contact, and the SharePoint pre-write lookup can be redirected so the node writes the submitted field values onto a list item the workflow never intended, both within the scope of the stored credential.\r\n\r\n## Patches\r\n\r\nThe issue has been fixed in n8n versions 1.123.85, 2.44.1, and 2.43.5. Users should upgrade to one of these versions or later to remediate the vulnerability.\r\n\r\n## Workarounds\r\n\r\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\r\n- Restrict n8n instance access to fully trusted users only.\r\n- Audit active workflows that use the Microsoft Outlook contact `getAll` operation or the Microsoft SharePoint v1 item update/upsert operation and remove any bindings that pass untrusted external data into the affected parameters.\r\n- Apply network-level controls to restrict access to webhook endpoints that feed into these workflows.\r\n- Deactivate affected workflows until the instance is patched.\r\n\r\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","categories":["Frameworks"],"product":"n8n","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-mgpr-56r4-5c67","source_modified_at":"2026-10-14T09:44:47Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 1.123.85"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-mgpr-56r4-5c67","source_modified_at":"2026-10-14T09:44:47Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.44.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-mgpr-56r4-5c67","source_modified_at":"2026-10-14T09:44:47Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.43.5"}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-14T09:44:47Z","modified_at":"2026-10-14T09:44:47Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-mgpr-56r4-5c67","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-14T09:44:47Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-14T09:44:47Z","content_hash":"a9bd39c0e85a4f69f7fc188d7a996d3e204cff1862a48663bd6f61ad5109e187"}}