The vulnerability is a classic SQL injection (CWE‑89) in the legacy MySQL v1 node of n8n. The executeQuery operation directly concatenates values resolved from {{ … }} expression evaluations into a raw SQL string, bypassing parameterization. When a workflow uses this node with expressions that receive data supplied by an externally reachable trigger, an attacker can inject arbitrary SQL and force its execution with the credentials configured for the node.

n8n workflow automation platform versions prior to 1.123.61, 2.x prior to 2.27.4, and 2.28.x prior to 2.28.1 are vulnerable. The newer MySQL v2 node, which employs parameterized queries, is not affected.

The CVSS score of 5.3 classifies the issue as moderate. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, through an exposed trigger such as a Webhook node; exploitation requires the workflow to invoke the vulnerable MySQL v1 node with expressions that accept external input. Successful exploitation would let an attacker execute arbitrary SQL statements and obtain the privileges of the configured database user.