CVE-2026-54687 in n8n-node-sqlite3
Summary
by MITRE • 08/27/2026
n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db_path database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to db_path can allow a remote attacker to select which SQLite file the n8n process opens, enabling traversal outside the intended database location and potentially reading, creating, or overwriting files accessible to the process. This issue is fixed in version 1.0.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified within the n8n-nodes-sqlite3 package prior to version 1.0.0 represents a critical path traversal and arbitrary file access flaw rooted in insufficient input validation of node parameters. The specific component affected is SqliteNode/v1/SqliteV1.node.ts, which serves as an interface for executing operations against local SQLite databases within the n8n automation workflow engine. In versions preceding 1.0.0, the db_path parameter, which dictates the location of the target database file, was configured to accept data expressions derived from upstream workflow inputs. This design choice inadvertently allowed dynamic input mapping where external or untrusted data sources could directly influence the filesystem path used by the SQLite driver. Consequently, a malicious actor who controls any part of the workflow input stream can manipulate this parameter to specify arbitrary paths rather than restricting access solely to intended database files within designated directories.
From an operational perspective, this flaw enables severe security implications including unauthorized file disclosure, creation, and modification. By leveraging path traversal techniques such as using dot-dot-slash sequences or absolute paths, a remote attacker can direct the n8n process to open SQLite databases located outside the sandboxed working directory. Since SQLite operates by opening files directly from the filesystem, this capability effectively grants the application context access to any file that the user account running the n8n service has permissions to read, write, or execute. This could lead to the exfiltration of sensitive configuration files, source code, environment variables, or other critical system data stored on the host machine. Furthermore, if the process possesses write privileges in specific directories, an attacker might overwrite existing files or create new executable scripts, potentially leading to remote code execution depending on subsequent workflow configurations and service permissions.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as it fails to enforce strict boundaries on user-supplied input when interacting with the file system. Additionally, it relates to CWE-94: Improper Control of Generation of Code (Code Injection) in contexts where path manipulation leads to unintended code execution or data corruption. In terms of the MITRE ATT&CK framework, this behavior is characteristic of T1083: File and Directory Discovery, as well as T1560: Archive Collected Data if the attacker uses the access to gather sensitive information for later exfiltration. The core issue lies in the lack of sanitization or validation logic that would strip relative path components or restrict the resolved absolute path to a predefined whitelist of allowed directories before passing it to the database engine.
To mitigate this vulnerability, organizations must immediately upgrade n8n-nodes-sqlite3 to version 1.0.0 or later, where the developers have implemented fixes to prevent arbitrary file selection via data expressions in the db_path parameter. For environments that cannot update immediately due to dependency constraints, it is imperative to restrict workflow inputs so that no untrusted external data can be mapped directly into database path parameters. Administrators should also enforce strict least-privilege principles by running n8n processes under dedicated service accounts with minimal filesystem permissions, ensuring that even if a traversal occurs, the attacker cannot access sensitive system files or critical application configurations outside of designated working directories. Regular auditing of workflow designs to identify nodes accepting dynamic input for file operations is recommended as part of a broader security hygiene strategy.