Jubke

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.61 n8n versions prior to 2.27.4 n8n versions 2.28.0 through 2.28.0 **Description** A SQL injection issue exists in the legacy MySQL v1 node during the `executeQuery` operation. The system substitutes evaluated `{{ ... }}` expression values directly into the raw SQL string without using parameterization. If a workflow utilizes this operation with expression-sourced values and is linked to an externally-reachable trigger, such as a Webhook node, an attacker can provide malicious input to execute arbitrary SQL commands using the privileges of the configured MySQL credentials. **Recommendations** Update to version 1.123.61 or later. Update to version 2.27.4 or later. Update to version 2.28.1 or later. As a temporary mitigation, avoid using the `executeQuery` operation in the legacy MySQL v1 node or restrict the use of expression-sourced values in that operation.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 2.24.0 **Description** The Compression node's Decompress operation expands attacker-controlled archives into memory without enforcing limits on the decompressed output size. An unauthenticated attacker can send a small compressed archive to a public webhook workflow utilizing this node, leading to memory exhaustion. This causes the n8n process to terminate, which disrupts all workflows running within the same instance. **Recommendations** Update to version 2.24.0 or later. As a temporary workaround, disable the Compression node by adding `n8n-nodes-base.compression` to the `NODES EXCLUDE` environment variable. Restrict public webhook workflows that accept archive file uploads to authenticated endpoints only.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.32 n8n versions prior to 2.17.4 n8n versions prior to 2.18.1 **Description** An open source workflow automation platform contains an issue where the Snowflake node and the legacy MySQL v1 node construct SQL queries by directly interpolating user-controlled table names, column names, and update keys into query strings without identifier escaping. This allows for SQL injection against the connected database. **Recommendations** Update to version 1.123.32. Update to version 2.17.4. Update to version 2.18.1.