This flaw allows malicious actors to inject arbitrary SQL into the Microsoft SQL node’s query field, potentially executing any command that the database user can run. By doing so, an attacker can read, modify, or delete data, directly compromising the confidentiality and integrity of the connected database. The vulnerability stems from direct substitution of user-supplied expressions into SQL text without parameterization, classified as a classic SQL injection weakness.

The affected product is n8n, developed by n8n-io. Versions prior to 2.41.4 and pre‑2.42.1 of the 2.42.x series are impacted. Workflows that bind external input such as webhook fields to the Microsoft SQL node’s query field are at risk.

The CVSS score of 7 indicates a moderate severity, and the vulnerability can be exploited by unauthenticated external callers. Based on the description, the likely attack vector involves sending crafted payloads to a publicly exposed webhook or trigger that feeds into the query field of the Microsoft SQL node. The EPSS score is not available, and this issue is not listed in the CISA KEV catalog, suggesting that while it is potentially impactful, current exploitation data is limited.