GHSA-mhrx-qhrj-673w

Source

https://github.com/advisories/GHSA-mhrx-qhrj-673w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-mhrx-qhrj-673w/GHSA-mhrx-qhrj-673w.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mhrx-qhrj-673w

Aliases

CVE-2026-44792

Published

2026-05-14T16:18:00Z

Modified

2026-05-14T16:39:53.478611Z

Severity

8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator

Summary

n8n Has a Source Control Pull SQL Injection

Details

Impact

An attacker with write access to the git repository connected to an n8n Source Control configuration could commit a malicious Data Table JSON file containing a crafted column name. When an administrator performed a Source Control Pull, n8n imported the file and could lead to SQL injection on the internal PostgreSQL instance.

Exploitation requires all of the following conditions: - The n8n instance uses PostgreSQL as its database backend. - The Source Control feature is enabled and connected to a repository the attacker can write to. - An administrator triggers a Source Control Pull.

Patches

The issue has been fixed in n8n version 1.123.43, 2.20.7, and 2.21.1. Users should upgrade to this version or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Disable the Source Control feature if it is not actively required. - Restrict write access to the connected git repository to fully trusted users only. - Avoid pulling from repositories that may have been modified by untrusted parties.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Database specific

{
    "github_reviewed": true,
    "severity": "HIGH",
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-89"
    ],
    "github_reviewed_at": "2026-05-14T16:18:00Z"
}

References

Affected packages

npm / n8n

Package

Name: n8n; View open source insights on deps.dev
Purl: pkg:npm/n8n

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.123.43

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-mhrx-qhrj-673w/GHSA-mhrx-qhrj-673w.json"

npm / n8n

Package

Name: n8n; View open source insights on deps.dev
Purl: pkg:npm/n8n

Affected ranges

Type: SEMVER
Events: Introduced

2.21.0

Fixed

2.21.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-mhrx-qhrj-673w/GHSA-mhrx-qhrj-673w.json"

npm / n8n

Package

Name: n8n; View open source insights on deps.dev
Purl: pkg:npm/n8n

Affected ranges

Type: SEMVER
Events: Introduced

2.0.0-rc.0

Fixed

2.20.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-mhrx-qhrj-673w/GHSA-mhrx-qhrj-673w.json"