An authenticated user who can create or modify workflows may use the Merge node’s "Combine by SQL" mode to execute arbitrary SQL statements. The underlying AlaSQL sandbox fails to restrict certain SQL commands, allowing the attacker to read local files and ultimately execute code on the n8n host. The vulnerability is classified as a high‐severity remote code execution flaw that can compromise confidentiality, integrity and availability of the entire system. It maps to well‑known weaknesses such as SQL injection (CWE‑89) and code injection via dynamic execution (CWE‑94).

The flaw affects n8n workflow automation platform versions prior to 2.14.1, 2.13.3 and 1.123.26. Users running n8n 2.14.0, any 2.13.x version earlier than 2.13.3, or 1.123.25 and earlier are impacted and must consider remediation. The platform runs on Node.js, and the vulnerability is tied to the Merge node implementation contained in the open source code base.

The CVSS score of 9.4 reflects the severe impact of the vulnerability, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The issue does not appear in the CISA KEV catalog, but the requirement of an authenticated user with workflow creation rights increases the attack surface to internal or compromised accounts. An attacker with those permissions can trigger the vulnerable code path and gain full control over the host. Therefore the risk is high for organizations where such user roles are widely distributed, and precautionary steps should be taken immediately.