CVE-2026-85167

n8n versions before 2.35.4 and 2.36.x before 2.36.2 are affected by a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query nodes. The root cause is that these operations build their JSON query by interpolating expression values directly int...

CVE-2026-85167 n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes

n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the query string before parsing. A value...

EXPLOIT-CVE-2021-44228

CVE-2021-44228 — Log4Shell PoC Lab 면책 조항 이 실습 환경은 보안 교육 및 연구 목적으로만 제작되었습니다. 모든 트래픽은 격리된 Docker 네트워크 내에서 발생합니다. 실제 시스템이나 명시적인 허가 없이 이 자료를 사용하지 마세요. 오용은 범죄가 될 수 있습니다. 책임감 있게 사용하세요. CVE-2021-44228이란? Log4Shell 은 2021년 12월에 Java 애플리케이션에서 널리 사용되는 로깅 라이브러리 Apache Log4j 2 에서 발견된 치명적인 취약점CVSS 10.0입니다. 취약...

EUVD-2026-56140

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL...

CVE-2026-72750

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL...

GHSA-HWMJ-QG4V-CVG9 n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

Impact The legacy MySQL v1 node's executeQuery operation substitutes evaluated ... expression values directly into the raw SQL string without parameterization. If a workflow uses this operation with expression-sourced values in the query and is connected to an externally-reachable trigger such as...

CVE-2026-59257 n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolation

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated ... expression values directly into the raw SQL string without parameterization. When a workflow uses...