CyberRota Analysis
AI-GeneratedThe Supabase node in n8n versions prior to 1.123.69, 2.33.4, and 2.34.1 is vulnerable to a PostgREST filter injection, allowing attackers to manipulate filter queries and potentially access, delete, or modify all rows in a database instead of a targeted single row. This vulnerability poses a significant risk to data integrity and confidentiality, making it critical for organizations using affected versions of n8n to prioritize immediate remediation. Users of n8n, particularly those managing sensitive data, should urgently update to the patched versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations, which built filter queries by concatenating an expression-bindable value without escaping. An attacker could inject a condition that widened the filter to match every row, turning an intended single-row operation into full-table disclosure, deletion, or modification.
Related CVEs
Other vulnerabilities affecting the same vendor(s)