The vulnerability arises from the orderByColumn expression in the Data Table Get node of n8n, where external or user-supplied input is concatenated directly into an SQL statement. This omission of proper sanitization enables an attacker to inject arbitrary SQL. When executed against SQLite the injection is limited to single statements, but on PostgreSQL the attacker can submit multiple statements, allowing modification or deletion of data. The weakness aligns with CWE‑89: Improper Neutralization of Special Elements used in an SQL Command.

Affected users are running n8n versions prior to 1.123.26, 2.13.3, or 2.14.1. The impact is only present when the Data Table Get node is enabled and the database is SQLite or PostgreSQL. The attacker must have authenticated access that permits creating or editing workflows, as the vulnerability is triggered by supplying a crafted expression in the node configuration.

The CVSS base score of 8.7 classifies the flaw as high severity, while the EPSS score of less than 1% indicates a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires legitimate user credentials with workflow‑edit rights; once achieved, the attacker can inject SQL targeting the configured database. Mitigations such as limiting workflow‑edit permissions, excluding the Data Table node, or reviewing existing workflows provide short‑term protection but do not constitute a full fix.