The SeaTable node in n8n prior to versions 1.123.32, 2.17.4, and 2.18.1 allows user-controlled input to be concatenated directly into SQL query strings without escaping or parameterization. This SQL injection flaw enables an attacker to manipulate the query to retrieve unintended rows from the linked SeaTable base, effectively bypassing any row‑level filtering logic defined in the workflow. The result is that confidential data can be disclosed to an unauthorized party.

Affected systems are installations of the open‑source workflow automation platform n8n provided by n8n‑io. Any instance using an earlier release than 1.123.32 for version 1.x, 2.17.4 for 2.x, or 2.18.1 for the latest 2.x branch is vulnerable. The flaw originates in the SeaTable node’s row:search and row:get operations.

The CVSS score of 5.3 reflects a moderate severity with medium confidentiality impact and no authentication requirement. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting a relatively low exploitation probability. The likely attack vector is through expressions that supply external user input to the SeaTable node; an attacker can craft the input within a workflow that is executed by the system, making the vulnerability exploitable in a deployed environment.