CVE-2026-59257

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated ... expression values directly into the raw SQL string without parameterization. When a workflow uses...

CVE-2026-59257

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated ... expression values directly into the raw SQL string without parameterization. When a workflow uses...

CVE-2026-59257 n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolation

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated ... expression values directly into the raw SQL string without parameterization. When a workflow uses...

CVE-2026-59257

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated ... expression values directly into the raw SQL string without parameterization. When a workflow uses...

CVE-2026-59257 n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolation

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated ... expression values directly into the raw SQL string without parameterization. When a workflow uses...

CVE-2026-59257

This CVE affects n8n before 1.123.61 and 2.x before 2.27.4, specifically the legacy MySQL v1 node’s executeQuery operation. The root cause is that evaluated {{ ... }} expression values are substituted directly into the raw SQL string without parameterization, enabling SQL injection when a workflo...

CVE-2026-59257 n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolation

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated ... expression values directly into the raw SQL string without parameterization. When a workflow uses...

sqlilabs-waf-bypass

SQLi-Labs WAF Bypass Project Target: http://home.ctfst...

CVE-2026-59257: Improper Neutralization of Special Elements used in an SQL Command

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated ... expression values directly into the raw SQL string without parameterization. When a workflow uses...

PT-2026-56448

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.61 n8n versions prior to 2.27.4 n8n versions 2.28.0 through 2.28.0 Description A SQL injection issue exists in the legacy MySQL v1 node during the executeQuery operation. The system substitutes evaluated...

PYSEC-2026-1110 aiomysql allows arbitrary access to client files through vulnerability of a malicious MySQL server

Summary The client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client using a rogue server. Details It is possible to create a rogue MySQL server that emulates authorization, ignores client flags and requests arbitrary...

apache-airflow-providers-fastetl (>=0.0.36, <=0.0.39) potentially affected by CVE-2025-27018 via apache-airflow-providers-mysql (5.7.3)

apache-airflow-providers-mysql PYPI version 5.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-mysql and may be impacted: - apache-airflow-providers-fastetl =0.0.36, =0.0.39 Source cves: CVE-2025-27018 Source advisory:...

airflow-operators (>=0.1.0, <=0.11.1) potentially affected by CVE-2025-27018 via apache-airflow-providers-mysql (5.7.4)

apache-airflow-providers-mysql PYPI version 5.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-mysql and may be impacted: - airflow-operators =0.1.0, =0.11.1 Source cves: CVE-2025-27018 Source advisory: OSV:PYSEC-2026-1151...

ibor-airflow-providers (0.3.0) potentially affected by CVE-2025-27018 via apache-airflow-providers-mysql (5.4.0)

apache-airflow-providers-mysql PYPI version 5.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-mysql and may be impacted: - ibor-airflow-providers 0.3.0 Source cves: CVE-2025-27018 Source advisory: OSV:PYSEC-2026-1151...

PYSEC-2026-1151 Apache Airflow MySQL Provider is Vulnerable to SQL Injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG with dumpsql or loadsql functions they could pass a table parameter from a UI, that could cause SQL injection by running SQL that was not...

santoku (>=200902.10.0, <=201111.17.0) potentially affected by CVE-2024-21272 via mysql-connector-python (8.0.5)

mysql-connector-python PYPI version 8.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on mysql-connector-python and may be impacted: - santoku =200902.10.0, =201111.17.0 Source cves: CVE-2024-21272 Source advisory: OSV:PYSEC-2026-1685...

botsislabutils (1.0.0), pxtextmining (>=0.2.5, <=0.4.2) +1 more potentially affected by CVE-2024-21272 via mysql-connector-python (8.0.23)

mysql-connector-python PYPI version 8.0.23 is affected by a known vulnerability. The following packages have a transitive dependency on mysql-connector-python and may be impacted: - botsislabutils 1.0.0 - pxtextmining =0.2.5, =0.4.2 - tweetle 1.0.1 Source cves: CVE-2024-21272 Source advisory:...

opengamedata-api-utils (>=1.1.0, <=1.1.1), opengamedata-common (>=0.0.1, <=1.2.2) +2 more potentially affected by CVE-2024-21272 via mysql-connector-python (8.0.25)

mysql-connector-python PYPI version 8.0.25 is affected by a known vulnerability. The following packages have a transitive dependency on mysql-connector-python and may be impacted: - opengamedata-api-utils =1.1.0, =0.0.1, =1.0.0.dev782, =1.0.0.dev782, =7.1.2 Source cves: CVE-2024-21272 Source...

afs2-datasource (>=3.8.0.0, <=3.8.2), base-automation (>=0.0.2, <=0.0.8) +2 more potentially affected by CVE-2024-21272 via mysql-connector-python (8.0.26)

mysql-connector-python PYPI version 8.0.26 is affected by a known vulnerability. The following packages have a transitive dependency on mysql-connector-python and may be impacted: - afs2-datasource =3.8.0.0, =0.0.2, =2.1.0b12, =0.1.4, =1.0.1456 Source cves: CVE-2024-21272 Source advisory:...

azelia-hash (>=0.1.0, <=0.1.1), core-test-utils (1.0.0) +3 more potentially affected by CVE-2024-21272 via mysql-connector-python (8.0.27)

mysql-connector-python PYPI version 8.0.27 is affected by a known vulnerability. The following packages have a transitive dependency on mysql-connector-python and may be impacted: - azelia-hash =0.1.0, =1.0.1, =1.0.2, =2.0.0b2, =2.0.0rc2 Source cves: CVE-2024-21272 Source advisory:...