n8n before versions 1.123.85, 2.43.5, and 2.44.1 contains an OData $filter injection flaw in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes. By building “$filter” string literals from expression‑bindable parameters without escaping, an attacker can inject single quotes that cause the entire contact list of the bound mailbox to be returned or redirect SharePoint writes onto unintended list items within the stored credential’s scope. This is a classic CWE‑943 vulnerability.

The affected product is n8n workflow software from n8n‑io. Versions earlier than 1.123.85, 2.43.5, and 2.44.1 are vulnerable. The Outlook and SharePoint nodes in those releases are the components that expose the flaw.

The CVSS score of 6.9 marks the flaw as a moderate severity vulnerability. The EPSS score is not available, so assessment relies on the CVSS score and the potential exposure of user data to untrusted inputs. The flaw is not listed in the CISA KEV catalog, indicating that large‑scale exploitation has not been documented, but the ability to dump sensitive contact information or alter SharePoint items poses a significant risk to confidentiality and integrity when workflows accept external user input.