This vulnerability allows an authenticated user to execute arbitrary SQL against the PostgreSQL database that a workflow accesses. The flaw is in the PostgresTrigger node, which concatenates user‑supplied identifiers—channel, function, and trigger names—directly into SQL statements without proper escaping. The weakness (CWE‑89) can be leveraged to read, modify, or delete data in the hooked database, potentially compromising the integrity and confidentiality of the application’s data store.

The affected product is n8n, an open‑source workflow automation tool provided by n8n‑io. Vulnerable releases include any n8n version prior to 1.123.67, as well as the 2.31.5 and 2.32.1 stable releases. Users running these versions on servers that have a PostgresTrigger node configured are exposed to this risk.

The CVSS v3 score of 5.8 indicates medium severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalogue, suggesting no documented widespread exploitation at this time. Exploitation requires a valid authenticated session to the application; an attacker must first acquire or compromise legitimate credentials. Once authenticated, the attacker can inject arbitrary SQL that runs with the privileges of the database credentials configured in the node, allowing full read and write access to the connected database. This could lead to data theft, manipulation, or deletion, thereby impacting the confidentiality and integrity of the data stored in PostgreSQL.