n8n: Quick Base Node Allows Filter Injection Through the Where Parameter

Impact

The Quick Base node sends the Where filter to the Quick Base API as raw query text. Where a workflow builds this filter from untrusted input, such as webhook data, an external caller can change the filter logic: a Get Many returns every record in the table and a Delete removes every record, with the privileges of the workflow's credential. Use the new Where Parameters option for dynamic values; a Where filter built with an expression stays unsafe.

Patches

The issue has been fixed in n8n versions 1.123.85, 2.44.1, and 2.43.5. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Audit active workflows that use the Quick Base node and ensure the Where parameter does not incorporate untrusted external data via expressions.
• Apply network-level controls to restrict access to webhook endpoints that feed into Quick Base record:delete or record:getAll operations.
• Disable the Quick Base node by adding n8n-nodes-base.quickBase to the NODES_EXCLUDE environment variable if it is not required.
• If the node is used as an agent tool, review and restrict which agents have access to it.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.