n8n-nodes-sqlite3: Path traversal via user-controlled database file path (db_path parameter)
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db_path database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to db_path can allow a remote attacker to select which SQLite file the n8n process opens, enabling traversal outside the intended database location and potentially reading, creating, or overwriting files accessible to the process. This issue is fixed in version 1.0.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| DangerBlack | n8n-node-sqlite3 | before 1.0.0 | 1.0.0 | Patch available | CNA |
| — | n8n-nodes-sqlite3 (npm) | before 1.0.0 | 1.0.0 | Patch available | GHSA-q7m3-rhxg-7vxr |
- n8n-node-sqlite3 VendorDangerBlack Affected before 1.0.0 Fixed in 1.0.0 Patch available CNA
- n8n-nodes-sqlite3 (npm) Vendor— Affected before 1.0.0 Fixed in 1.0.0 Patch available GHSA-q7m3-rhxg-7vxr
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dangerblack:n8n-node-sqlite3:1.0.0:*:*:*:*:node.js:*:* | 1.0.0 | Vulnerable | DangerBlack |
- cpe:2.3:a:dangerblack:n8n-node-sqlite3:1.0.0:*:*:*:*:node.js:*:* Versions 1.0.0 Vulnerable ·DangerBlack
Remediation
- Fix · CNA n8n-node-sqlite3 (DangerBlack) Fixed in 1.0.0
- Fix · GHSA-q7m3-rhxg-7vxr n8n-nodes-sqlite3 (npm) Fixed in 1.0.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54687
- 2026-10-03 Alias added: GHSA-q7m3-rhxg-7vxr
- 2026-10-25 EPSS moved to the 50th–90th percentile
References
Sources
- CVE-2026-54687 · CVE Program
- CVE-2026-54687 · NVD
- FIRST EPSS
- GHSA-q7m3-rhxg-7vxr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences