GHSA-Q7M3-RHXG-7VXR

Vulnerability from github – Published: 2026-08-27 17:06 – Updated: 2026-08-27 17:06
VLAI
Summary
n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)
Details

Affected versions

< 1.0.0

Patched version

1.0.0

Description

In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the db_path field could allow an attacker to control which file was opened by SQLite, potentially enabling path traversal to read or overwrite arbitrary files accessible to the n8n process.

The vulnerability requires the workflow author to explicitly wire untrusted input to the db_path parameter, so it does not affect standalone deployments where only trusted users author workflows. However, in multi-tenant or user-facing n8n deployments the risk is elevated.

Fixed in v1.0.0 by moving the database path into a credential (v2 node architecture), which is stored server-side and not controllable by workflow input data.

References

  • Fix commit: 145a887
  • Introduced credential-based path: v2 node

Credits

dyingman1 (role: Reporter)

Severity
6.1 (Medium)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "n8n-nodes-sqlite3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54687"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-27T17:06:55Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Affected versions\n\u003c 1.0.0\n\n## Patched version\n1.0.0\n\n## Description\nIn versions prior to 1.0.0, the SQLite node accepted the database file\npath as a direct node parameter visible and editable in the workflow.\nA workflow author who mapped untrusted user input to the db_path field\ncould allow an attacker to control which file was opened by SQLite,\npotentially enabling path traversal to read or overwrite arbitrary\nfiles accessible to the n8n process.\n\nThe vulnerability requires the workflow author to explicitly wire\nuntrusted input to the db_path parameter, so it does not affect\nstandalone deployments where only trusted users author workflows.\nHowever, in multi-tenant or user-facing n8n deployments the risk\nis elevated.\n\nFixed in v1.0.0 by moving the database path into a credential\n(v2 node architecture), which is stored server-side and not\ncontrollable by workflow input data.\n\n## References\n- Fix commit: 145a887\n- Introduced credential-based path: v2 node\n\n## Credits\ndyingman1 (role: Reporter)",
  "id": "GHSA-q7m3-rhxg-7vxr",
  "modified": "2026-08-27T17:06:55Z",
  "published": "2026-08-27T17:06:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/DangerBlack/n8n-node-sqlite3/security/advisories/GHSA-q7m3-rhxg-7vxr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/DangerBlack/n8n-node-sqlite3/pull/25"
    },
    {
      "type": "WEB",
      "url": "https://github.com/DangerBlack/n8n-node-sqlite3/commit/145a8876ff12375813bdcd4ae4fe78f460c53a98"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/DangerBlack/n8n-node-sqlite3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.