PT-2026-36901 · Seatable+1 · Seatable+1

Sm1Ee · Published 2026-04-22 · Updated 2026-05-06 · CVE-2026-42229

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.32 n8n versions prior to 2.17.4 n8n versions prior to 2.18.1

Description A flaw in the SeaTable node's 'row:search' and 'row:get' operations allows user-controlled input to be concatenated directly into SQL query strings without escaping or parameterization. In workflows where external user input is passed via expressions into the search or row retrieval parameters, an attacker could manipulate the constructed query to retrieve unintended rows from the connected SeaTable base, bypassing row-level filtering logic.

Recommendations Update to version 1.123.32. Update to version 2.17.4. Update to version 2.18.1.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2026-06926

CVE-2026-42229

GHSA-MP4J-H6GH-F6MP

Affected Products

Seatable

N8N

References · 10

• https://github.com/n8n-io/n8n/security/advisories/GHSA-mp4j-h6gh-f6mp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42229 · Security Note
• https://bdu.fstec.ru/vul/2026-06926 · Security Note
• https://osv.dev/vulnerability/GHSA-mp4j-h6gh-f6mp · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/CVEnew/status/2051383976162394210 · Twitter Post
• https://t.me/cveNotify/162369 · Telegram Post
• https://t.me/cveNotify/162078 · Telegram Post
• https://twitter.com/infoflowcloud/status/2051385391383552103 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051526527204868399 · Twitter Post