www.vulncheck.com OData Filter Injection Vulnerabilities in n8n Affecting Multiple Nodes
Article Content
Browse articles 
- •n8n versions before 1.123.85, 2.43.5, and 2.44.1 are vulnerable to OData filter injection.
- •The vulnerabilities affect Outlook, SharePoint, and Quick Base nodes in n8n.
- •No active exploitation or proof-of-concept code has been reported for these vulnerabilities.
Two vulnerabilities have been identified in n8n versions prior to 1.123.85, 2.43.5, and 2.44.1, allowing OData filter injection via Outlook, SharePoint, and Quick Base nodes. The vulnerabilities are classified under CWE-943 for improper neutralization of special elements in data query logic. The affected versions include n8n >= 2.44.0, = 2.44.0, and < 2.43.5. GitHub Security Advisory GHSA-mgpr-56r4-5c67 and GHSA-65mv-v8rp-54wc have documented these issues. There is no indication of or proof-of-concept code available at this time. Users are advised to update to the latest versions to mitigate these vulnerabilities. The vulnerabilities were disclosed on 2026-10-29.
Ask AI about this cluster
Answers cite the sources they use
Updated just now How this analysis works
Timeline
More articles in this cluster (2)
Common questions
Which versions of n8n are affected?
n8n versions before 1.123.85, 2.43.5, and 2.44.1 are affected.
Is there any active exploitation of these vulnerabilities?
No, there are currently no reports of active exploitation or proof-of-concept code.
What should users do to protect themselves?
Users should update to the latest versions of n8n to mitigate these vulnerabilities.
Continue Reading
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25… 
Volt Typhoon's Silent Train Network Targets US Critical Infrastructure The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access…