CVE-2026-33660: n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode

An authenticated user with permission to create or modify workflows could use the Merge node’s “Combine by SQL” mode to read local files on the n8n host and achieve remote code execution. The AlaSQL sandbox did not sufficiently restrict certain SQL statements, allowing an attacker to access sensitive files on the server or even compromise the intance.