n8n: SQL Injection in the Microsoft SQL Node via Expression Interpolation into the Query Field

Impact

Version 1 of the Microsoft SQL node resolves an expression in the Query field by substituting the value into the SQL text and executing the result, with no parameterisation. Where a workflow binds untrusted input into that field, an external caller can execute arbitrary SQL against the connected database with the stored credential's privileges.

Patches

The issue has been fixed in n8n versions 2.42.1 and 2.41.4. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Audit all workflows using the Microsoft SQL node and ensure that the Query field is not bound to expressions referencing untrusted external input such as webhook or HTTP request fields.
• Deactivate webhook-triggered workflows that pass external input into a Microsoft SQL node's Query field until the instance is patched.
• Where the node must remain in use, upgrade the node to typeVersion 1.1 or later by removing and re-adding it, then move dynamic values into the Query Parameters option and reference them as positional parameters.