Improper Neutralization of Special Elements in Data Query Logic in n8n - #VU155720
Published: October 14, 2026
Vulnerability details
The vulnerability allows a remote user to modify a SharePoint list item that the workflow did not intend to update.
The vulnerability exists due to improper neutralization of query syntax in the Microsoft SharePoint v1 node's pre-write item lookup when constructing an OData $filter string literal from an expression-bound parameter. A remote user can supply a value containing a single quote that closes the literal and redirects the lookup to modify a SharePoint list item that the workflow did not intend to update.
Exploitation requires a workflow that binds untrusted input into the affected parameter. The node writes the submitted field values, and access remains within the scope of the stored credential.