Vulnerability Description
n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db_path database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to db_path can allow a remote attacker to select which SQLite file the n8n process opens, enabling traversal outside the intended database location and potentially reading, creating, or overwriting files accessible to the process. This issue is fixed in version 1.0.0.
Related Weaknesses (CWE)
References
- https://github.com/DangerBlack/n8n-node-sqlite3/commit/145a8876ff12375813bdcd4ae
- https://github.com/DangerBlack/n8n-node-sqlite3/pull/25
- https://github.com/DangerBlack/n8n-node-sqlite3/security/advisories/GHSA-q7m3-rh
FAQ
What is CVE-2026-54687?
CVE-2026-54687 is a documented vulnerability. n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the db_path database file path as a node parameter that permits...
How severe is CVE-2026-54687?
CVSS scoring is not yet available for CVE-2026-54687. Check NVD for updates.
Is there a patch for CVE-2026-54687?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.