Description

Detects when a SQL node in the published version of an n8n workflow runs a raw query that embeds an expression, so the value the expression returns becomes part of the statement text. Data that reaches the workflow from a webhook, a form or another node can then change the query and read, alter or delete records with the privileges of the node's database credential.

Detection Strategy

• Lists every workflow the API key's user can see through the n8n public API, all of them for an owner or admin key, and reads only the version of each one that is published, skipping disabled nodes

• Keeps the nodes whose operation runs a raw query: execute on Oracle Database, and executeQuery on CrateDB, Microsoft SQL, MySQL, Postgres, QuestDB, Snowflake and TimescaleDB, their tool variants included; an operation that is itself an expression is kept as well

• Reads the query text of each kept node and looks for the double braces that open an n8n expression

• Reports a vulnerability when the query embeds an expression, recording that fact rather than the query itself in the evidence; a workflow whose listing omits the published version field, or whose published version has no node list, is recorded as unreadable rather than reported as clean