The vulnerability is a classic SQL injection flaw in the Snowflake node’s Execute Query operation, where untrusted expression data is interpolated directly into the SQL string without parameterization. This flaw allows an attacker to inject arbitrary SQL statements, potentially compromising data confidentiality, integrity, or availability. The weakness is classified as CWE‑89, a classic injection defect.

The flaw affects the n8n workflow automation platform in the following releases: any version prior to 1.123.67, version 2.31.5, and version 2.32.1. The affected code resides in the Snowflake node’s Execute Query operation, which is used by workflow authors to run custom SQL queries against a Snowflake data warehouse.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited exploitation evidence. The likely attack vector is local: a malicious workflow author or an attacker who can supply untrusted expression data to the Execute Query operation, if such data can flow from an external source. If the attacker controls the workflow, the impact can be significant, as arbitrary SQL code would execute within the Snowflake environment.