OData $filter Injection in Microsoft Outlook and SharePoint v1 Nodes

Impact

The Microsoft Outlook contact lookup and the Microsoft SharePoint v1 item update build an OData $filter string literal from an expression-bindable parameter without escaping it. A single quote in the value closes the literal and rewrites the query. Where a workflow binds untrusted input into those fields, the Outlook lookup returns the bound mailbox's entire contact list instead of one contact, and the SharePoint pre-write lookup can be redirected so the node writes the submitted field values onto a list item the workflow never intended, both within the scope of the stored credential.

Patches

The issue has been fixed in n8n versions 1.123.85, 2.44.1, and 2.43.5. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Audit active workflows that use the Microsoft Outlook contact getAll operation or the Microsoft SharePoint v1 item update/upsert operation and remove any bindings that pass untrusted external data into the affected parameters.
• Apply network-level controls to restrict access to webhook endpoints that feed into these workflows.
• Deactivate affected workflows until the instance is patched.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.