The vulnerability is a PostgREST filter injection in the Supabase node’s Row Get Many, Delete, and Update operations. Filters are constructed by concatenating an expression‑bindable value without escaping, enabling an attacker to inject a filter expression that expands the intended condition. This flaw permits full‑table disclosure, accidental mass deletion, or unauthorized data modification, thereby compromising both confidentiality and integrity of the database. The weakness is a classic SQL injection (CWE‑89).

The affected product is n8n by n8n‑io. Versions before 1.123.69 of the 1.x release and the 2.33.4 and 2.34.1 releases of the 2.x branch are vulnerable. All later versions maintain the fix and are considered unaffected.

The CVSS score of 7.1 classifies the issue as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the primary attack vector is sending crafted HTTP requests that target the Supabase API endpoints constructed by the node. Such requests can be issued from any host that can reach the n8n instance, making the risk significant for exposed or unauthenticated deployments.