{"id":"CVE-2026-103253","published":"2026-10-01T11:17:19.343","lastModified":"2026-10-01T16:17:35.727","description":"n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute DDL or DML commands against the connected database with the credential's privileges.","cvssScore":8.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-4wf3-rgqr-xcp3","tags":[]},{"url":"https://www.vulncheck.com/advisories/n8n-before-1.123.80-2.39.6-and-2.40.1-sql-injection-via-oracle-database-drop-table","tags":[]}],"exploitRefs":[{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-4wf3-rgqr-xcp3","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows SQL injection, enabling attackers to execute arbitrary DDL or DML commands with the database connection's privileges, potentially leading to data loss or corruption.","exploitability":"Exploitation is relatively straightforward as attackers can inject single quotes to append SQL statements, requiring only basic knowledge of SQL injection techniques.","blast_radius":"If exploited, the impact could be severe, including unauthorized data manipulation or database compromise, affecting the integrity and confidentiality of the connected database.","remediation":"Upgrade to n8n version 1.123.80 or later, 2.39.6 or later, or 2.40.1 or later, as applicable.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","database","rce","patch"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:55:45.407Z"}}