DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-652Q-GVQ3-74QV: GHSA-652q-gvq3-74qv: SQL Injection in n8n Snowflake Node via Unparameterized Expression Interpolation

#security #cve #cybersecurity #ghsa

GHSA-652q-gvq3-74qv: SQL Injection in n8n Snowflake Node via Unparameterized Expression Interpolation

Vulnerability ID: GHSA-652Q-GVQ3-74QV
CVSS Score: 5.3
Published: 2026-07-22

A SQL Injection vulnerability exists in the n8n Snowflake node's executeQuery operation. The vulnerability is caused by improper neutralization of expressions interpolated directly into database query strings. When raw Snowflake queries are built using untrusted external data without parameterization, an attacker can execute arbitrary SQL commands on the subsequent Snowflake database instance.

TL;DR

The n8n Snowflake node allows SQL Injection due to direct text interpolation of visual expressions. Upgrading to 1.123.67, 2.31.5, or 2.32.1 and migrating to 'Query Parameters' parameterization secures the application.

Technical Details

  • CWE ID: CWE-89
  • Attack Vector: Network
  • CVSS Score: 5.3
  • EPSS Score: N/A
  • Exploit Status: none
  • CISA KEV Status: Not Listed

Affected Systems

  • n8n self-hosted instances using Snowflake integration node
  • n8n: < 1.123.67 (Fixed in: 1.123.67)
  • n8n: >= 2.0.0-rc.0, < 2.31.5 (Fixed in: 2.31.5)
  • n8n: >= 2.32.0, < 2.32.1 (Fixed in: 2.32.1)

Exploit Details

Mitigation Strategies

  • Upgrade the n8n application to a patched version immediately.
  • Refactor workflows to replace direct template interpolation with parameterized inputs using positional markers (?).
  • Apply least-privilege principles to database credentials utilized by the Snowflake node configuration.

Remediation Steps:

  1. Identify all n8n instances and check their active versions.
  2. Upgrade n8n deployments to 1.123.67, 2.31.5, or 2.32.1 depending on the release track.
  3. Audit active workflows using the PostgreSQL metadata query to find active Snowflake executeQuery nodes.
  4. Refactor identified SQL statements: change SELECT * FROM table WHERE col = '{{ $json.val }}' to SELECT * FROM table WHERE col = ?.
  5. Activate 'Query Parameters' optional field on the Snowflake node and insert the corresponding variable expressions.

References

Read the full report for GHSA-652Q-GVQ3-74QV on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)