n8n is an open‑source workflow automation platform. Prior to versions 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could supply crafted parameters to the TimescaleDB and/or legacy Postgres v1 node, allowing arbitrary SQL to be injected and executed against the connected PostgreSQL database with the privileges of the database account configured for the node. The vulnerability is fixed in those releases.

The vulnerability exists in n8n versions prior to 2.25.7 (2.25.x series) and prior to 2.26.2 (2.26.x series). The affected component is the Postgres v1 node and TimescaleDB node within the workflow engine when they are configured to connect to a PostgreSQL database.

The CVSS score of 6.5 indicates moderate severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires authentication and sufficient workflow‑modification privileges; based on the description, it is inferred that the attack vector is internal. Once these conditions are met, an attacker can inject and execute arbitrary SQL, with the commands running using the privileges of the database account configured for the node. This allows direct alteration of database content, but the impact remains confined to database operations and does not provide broader system compromise.