CVE-2026-54687 is a critical path traversal flaw (CVSS 9.8) in the community package n8n-nodes-sqlite3 before 1.0.0. The v1 node takes the database file path as a parameter that can come from workflow input, so an attacker could pick which file the n8n process opens. Upgrade to 1.0.0.
What's affected
- n8n-nodes-sqlite3 before 1.0.0, per the record.
- Fixed in 1.0.0, which moves the database path into a credential stored on the server.
- The advisory says exploitation needs a workflow author to wire untrusted input to db_path. Multi-tenant and user facing deployments carry the most risk.
How to check if you're exposed
Check whether the community node is installed and which version.
npm ls n8n-nodes-sqlite3
In the n8n interface, check the installed community nodes list. Then open workflows that use the SQLite node and look at the db_path field. If it uses an expression that reads from a webhook, form or other external data, treat it as exposed.
What to do now
- Upgrade n8n-nodes-sqlite3 to 1.0.0 or later and move existing workflows to the v2 node that uses a credential for the path.
- Replace any expression in db_path with a fixed value.
- Run n8n under a user with access only to the directories it needs.
- Review which files the n8n process can read and write, and tighten that scope.
Why it matters
The class is CWE-22, path traversal. A value that selects a file on disk must be limited to an expected location. Here the field accepted expressions from upstream data, so the data decided which file was opened.
The design fix is instructive. Moving the path into a credential takes it out of reach of workflow input. The record does not mark the CVE as exploited in the wild. The score is high because the impact is reading or overwriting files the process can reach, but the condition that the workflow author must connect untrusted input limits real exposure.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if only trusted staff build workflows?
The advisory says the flaw does not affect standalone deployments where only trusted users author workflows. Upgrade anyway when convenient.
Sources
- https://github.com/DangerBlack/n8n-node-sqlite3/security/advisories/GHSA-q7m3-rhxg-7vxr
- https://github.com/DangerBlack/n8n-node-sqlite3/pull/25
Last reviewed: 19 October 2026.
