Exposure of Data Element to Wrong Session Affecting n8n-nodes-base package, versions <2.25.2>=2.26.0 <2.26.5

n8n-nodes-base is a Base nodes of n8n

Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the combineBySql Merge-node SQL Query path in combineBySql.ts. An authenticated attacker can poison the shared SQL sandbox by supplying a workflow that runs attacker-controlled SQL, causing prototype mutations to persist into later Merge SQL executions on the same instance. This allows the attacker to intercept data processed by other users’ workflows, breaking the isolation of workflow execution in multi-user n8n instances.

Notes

• This only affects multi-user n8n deployments where more than one user can create or execute workflows using Merge node SQL Query mode; single-user instances do not have the same cross-user persistence issue.
• The vulnerable path is the cached shared SQL sandbox used by repeated Merge SQL executions, so pollution can persist across later runs on the same instance rather than being limited to a single workflow execution.

Workarounds

• Limit workflow creation and editing permissions to fully trusted users only.
• Disable the Merge node by adding n8n-nodes-base.merge to the NODES_EXCLUDE environment variable.

• GitHub Commit
• GitHub Commit
• Maintainer's Advisory