n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)
Affected versions
< 1.0.0
Patched version
1.0.0
Description
In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the db_path field could allow an attacker to control which file was opened by SQLite, potentially enabling path traversal to read or overwrite arbitrary files accessible to the n8n process.
The vulnerability requires the workflow author to explicitly wire untrusted input to the db_path parameter, so it does not affect standalone deployments where only trusted users author workflows. However, in multi-tenant or user-facing n8n deployments the risk is elevated.
Fixed in v1.0.0 by moving the database path into a credential (v2 node architecture), which is stored server-side and not controllable by workflow input data.
References
- Fix commit: 145a887
- Introduced credential-based path: v2 node
Credits
dyingman1 (role: Reporter)
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | n8n-nodes-sqlite3 | < 1.0.0 | 1.0.0 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-22- Platform
- npm
- Package
n8n-nodes-sqlite3- Disclosed
- 27.08.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-q7m3-rhxg-7vxr - CC BY 4.0
Vulnerability history: n8n-nodes-sqlite3
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.