Skip to content

Commit a8fa1b0

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-98c2-4cr3-4jc3 GHSA-mxrg-77hm-89hv
1 parent 9f9fc28 commit a8fa1b0

2 files changed

Lines changed: 212 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-98c2-4cr3-4jc3/GHSA-98c2-4cr3-4jc3.json‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-98c2-4cr3-4jc3",
4+
"modified": "2026-03-26T16:41:26Z",
5+
"published": "2026-03-26T16:41:26Z",
6+
"aliases": [
7+
"CVE-2026-33713"
8+
],
9+
"summary": "n8n has SQL Injection in Data Table Node via orderByColumn Expression",
10+
"details": "## Impact\nAn authenticated user with permission to create or modify workflows could exploit a SQL injection vulnerability in the Data Table Get node. On default SQLite DB, single statements can be manipulated and the attack surface is practically limited. On PostgreSQL deployments, multi-statement execution is possible, enabling data modification and deletion.\n\n## Patches\nThe issue has been fixed in n8n versions 1.123.26, 2.13.3, and 2.14.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Limit workflow creation and editing permissions to fully trusted users only.\n- Disable the Data Table node by adding `n8n-nodes-base.dataTable` to the `NODES_EXCLUDE` environment variable.\n- Review existing workflows for Data Table Get nodes where `orderByColumn` is set to an expression that incorporates external or user-supplied input.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
15+
},
16+
{
17+
"type": "CVSS_V4",
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "npm",
25+
"name": "n8n"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"fixed": "1.123.26"
36+
}
37+
]
38+
}
39+
]
40+
},
41+
{
42+
"package": {
43+
"ecosystem": "npm",
44+
"name": "n8n"
45+
},
46+
"ranges": [
47+
{
48+
"type": "ECOSYSTEM",
49+
"events": [
50+
{
51+
"introduced": "2.14.0"
52+
},
53+
{
54+
"fixed": "2.14.1"
55+
}
56+
]
57+
}
58+
],
59+
"versions": [
60+
"2.14.0"
61+
]
62+
},
63+
{
64+
"package": {
65+
"ecosystem": "npm",
66+
"name": "n8n"
67+
},
68+
"ranges": [
69+
{
70+
"type": "ECOSYSTEM",
71+
"events": [
72+
{
73+
"introduced": "2.0.0-rc.0"
74+
},
75+
{
76+
"fixed": "2.13.3"
77+
}
78+
]
79+
}
80+
]
81+
}
82+
],
83+
"references": [
84+
{
85+
"type": "WEB",
86+
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-98c2-4cr3-4jc3"
87+
},
88+
{
89+
"type": "ADVISORY",
90+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33713"
91+
},
92+
{
93+
"type": "PACKAGE",
94+
"url": "https://github.com/n8n-io/n8n"
95+
}
96+
],
97+
"database_specific": {
98+
"cwe_ids": [
99+
"CWE-89"
100+
],
101+
"severity": "HIGH",
102+
"github_reviewed": true,
103+
"github_reviewed_at": "2026-03-26T16:41:26Z",
104+
"nvd_published_at": "2026-03-25T18:16:32Z"
105+
}
106+
}

‎advisories/github-reviewed/2026/03/GHSA-mxrg-77hm-89hv/GHSA-mxrg-77hm-89hv.json‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mxrg-77hm-89hv",
4+
"modified": "2026-03-26T16:41:01Z",
5+
"published": "2026-03-26T16:41:01Z",
6+
"aliases": [
7+
"CVE-2026-33696"
8+
],
9+
"summary": "n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE",
10+
"details": "## Impact\nAn authenticated user with permission to create or modify workflows could exploit a prototype pollution vulnerability in the GSuiteAdmin node. By supplying a crafted parameter as part of node configuration, an attacker could write attacker-controlled values onto `Object.prototype`. An attacker could use this prototype pollution to achieve remote code execution on the n8n instance.\n\n## Patches\nThe issue has been fixed in n8n versions 2.14.1, 2.13.3, and 1.123.27. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Limit workflow creation and editing permissions to fully trusted users only.\n- Disable the XML node by adding `n8n-nodes-base.xml` to the `NODES_EXCLUDE` environment variable.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
15+
},
16+
{
17+
"type": "CVSS_V4",
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "npm",
25+
"name": "n8n"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "2.14.0"
33+
},
34+
{
35+
"fixed": "2.14.1"
36+
}
37+
]
38+
}
39+
],
40+
"versions": [
41+
"2.14.0"
42+
]
43+
},
44+
{
45+
"package": {
46+
"ecosystem": "npm",
47+
"name": "n8n"
48+
},
49+
"ranges": [
50+
{
51+
"type": "ECOSYSTEM",
52+
"events": [
53+
{
54+
"introduced": "2.0.0-rc.0"
55+
},
56+
{
57+
"fixed": "2.13.3"
58+
}
59+
]
60+
}
61+
]
62+
},
63+
{
64+
"package": {
65+
"ecosystem": "npm",
66+
"name": "n8n"
67+
},
68+
"ranges": [
69+
{
70+
"type": "ECOSYSTEM",
71+
"events": [
72+
{
73+
"introduced": "0"
74+
},
75+
{
76+
"fixed": "1.123.27"
77+
}
78+
]
79+
}
80+
]
81+
}
82+
],
83+
"references": [
84+
{
85+
"type": "WEB",
86+
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-mxrg-77hm-89hv"
87+
},
88+
{
89+
"type": "ADVISORY",
90+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33696"
91+
},
92+
{
93+
"type": "PACKAGE",
94+
"url": "https://github.com/n8n-io/n8n"
95+
}
96+
],
97+
"database_specific": {
98+
"cwe_ids": [
99+
"CWE-1321"
100+
],
101+
"severity": "CRITICAL",
102+
"github_reviewed": true,
103+
"github_reviewed_at": "2026-03-26T16:41:01Z",
104+
"nvd_published_at": "2026-03-25T18:16:32Z"
105+
}
106+
}

0 commit comments

Comments
 (0)