What is GHSA-c37g-w77q-m4vp?

GHSA-c37g-w77q-m4vp is a security advisory published by GitHub Security Advisories with Medium severity. n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes

Which CVE IDs does GHSA-c37g-w77q-m4vp cover?

GHSA-c37g-w77q-m4vp covers the following CVE IDs: CVE-2026-54310. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c37g-w77q-m4vp?

GHSA-c37g-w77q-m4vp has a CVSS v3 base score of 9.9, published by GitHub Security Advisories.

Which products are affected by GHSA-c37g-w77q-m4vp?

GHSA-c37g-w77q-m4vp affects 2 products, including: npm/n8n:\u003e= 2.26.0, \u003c 2.26.2; npm/n8n:\u003c 2.25.7.

GHSA-c37g-w77q-m4vpMediumCVSS 9.9

n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes

Vendor

GitHub Security Advisories

Published

June 16, 2026

Last Modified

June 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-54310 →

📋 Description

Impact

An authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the connected database within the privileges of the configured database account.

Patches

The issue has been fixed in n8n versions 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

Limit workflow creation and editing permissions to fully trusted users only.
Disable the Postgres and TimescaleDB node by adding n8n-nodes-base.postgres, n8n-nodes-base.timescaleDb to the NODES_EXCLUDE environment variable.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

🎯 Affected products2

npm/n8n:>= 2.26.0, < 2.26.2
npm/n8n:< 2.25.7