CVE-2026-33713: n8n has SQL Injection in Data Table Node via orderByColumn Expression

March 26, 2026

An authenticated user with permission to create or modify workflows could exploit a SQL injection vulnerability in the Data Table Get node. On default SQLite DB, single statements can be manipulated and the attack surface is practically limited. On PostgreSQL deployments, multi-statement execution is possible, enabling data modification and deletion.

References

github.com/advisories/GHSA-98c2-4cr3-4jc3
github.com/n8n-io/n8n
github.com/n8n-io/n8n/security/advisories/GHSA-98c2-4cr3-4jc3
nvd.nist.gov/vuln/detail/CVE-2026-33713

Code Behaviors & Features

Detect and mitigate CVE-2026-33713 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →