A flaw in the Oracle Database node’s select operation permits user-controlled input supplied to the Limit field through expressions to be concatenated directly into the SQL statement without sanitization or parameterization. This is an instance of SQL injection (CWE‑89) that enables an attacker who can influence the Limit value to inject arbitrary SQL commands and exfiltrate data from the connected Oracle database.

The vulnerability affects n8n open‑source workflow automation platform versions older than 1.123.32, 2.17.4, and 2.18.1. Any workflow using the Oracle Database node with a Limit field populated from external sources such as webhooks is susceptible.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog, suggesting limited known exploitation. The attack would typically require an attacker to insert an expression into the Limit field—such as via a crafted webhook request—to trigger the injection and retrieve data. If the target database user has sufficient privileges, the attacker could read sensitive information, potentially compromising confidentiality and integrity of the data layer.