n8n has SQL Injection in Data Table Node via orderByColumn Expression
High9.9CVE-2026-33713 · Published Mar 26, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| n8n npm | < 1.123.26 | 1.123.26 |
| >= 2.14.0, < 2.14.1 | 2.14.1 | |
| >= 2.0.0-rc.0, < 2.13.3 | 2.13.3 |
Details and references
## Impact An authenticated user with permission to create or modify workflows could exploit a SQL injection vulnerability in the Data Table Get node. On default SQLite DB, single statements can be manipulated and the attack surface is practically limited. On PostgreSQL deployments, multi-statement execution is possible, enabling data modification and deletion. ## Patches The issue has been fixed in n8n versions 1.123.26, 2.13.3, and 2.14.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Limit workflow creation and editing permissions to fully trusted users only. - Disable the Data Table node by adding `n8n-nodes-base.dataTable` to the `NODES_EXCLUDE` environment variable. - Review existing workflows for Data Table Get nodes where `orderByColumn` is set to an expression that incorporates external or user-supplied input. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-89
- Also known as
- CVE-2026-33713
More n8n advisories
All n8n| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 25 | n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no CVE-2026-33724Medium5.4fixed in 2.5.0 | Medium5.4 | 2.5.0 |
| Mar 25 | n8n Has External Secrets Authorization Bypass in Credential Saving CVE-2026-33722High6.3fixed in 1.123.23, 2.6.4 | High6.3 | 1.123.23, 2.6.4 |
| Mar 25 | n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK CVE-2026-33720Medium4.7fixed in 2.8.0 | Medium4.7 | 2.8.0 |
| Mar 25 | n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover CVE-2026-33665High8.2fixed in 1.121.0, 2.4.0 | High8.2 | 1.121.0, 2.4.0 |
| Mar 25 | n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition CVE-2026-33663High9.9fixed in 1.123.27, 2.13.3, 2.14.1 | High9.9 | 1.123.27, 2.13.3, 2.14.1 |
| Mar 25 | n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode CVE-2026-33660Critical9.9fixed in 1.123.27, 2.13.3, 2.14.1 | Critical9.9 | 1.123.27, 2.13.3, 2.14.1 |