CVE-2026-59257: n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

The legacy MySQL v1 node’s executeQuery operation substitutes evaluated {{ ... }} expression values directly into the raw SQL string without parameterization. If a workflow uses this operation with expression-sourced values in the query and is connected to an externally-reachable trigger (such as a Webhook node), attacker-controlled input reaching those expressions results in SQL injection.

Successful exploitation allows arbitrary SQL execution with the configured MySQL credentials’ privileges, enabling unauthorized disclosure, modification, or deletion of data in the downstream database. MySQL v2 node is not affected.

This issue can affect only instances running workflows that use the MySQL v1 node with executeQuery operations.