CVE-2026-54687: 
JavaScript vulnerability analysis and mitigation

CVE-2026-54687 is a path traversal vulnerability in the n8n-nodes-sqlite3 npm package (also published as n8n-node-sqlite3 by DangerBlack), a community node for operating a local SQLite database from the n8n workflow automation platform. In versions prior to 1.0.0, the db_path parameter in nodes/SqliteNode/v1/SqliteV1.node.ts was exposed as a workflow node parameter that accepted n8n data expressions, allowing untrusted upstream input to control which SQLite file the n8n process opens. The vulnerability was reported by dyingman1 via coordinated disclosure on 2026-04-26, published as a GitHub Security Advisory (GHSA-q7m3-rhxg-7vxr) on June 26, 2026, and added to the GitHub Advisory Database on August 27, 2026. It carries a CVSS v4.0 base score of 6.1 (Medium) (GitHub Advisory).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal): the db_path node parameter lacked the noDataExpression: true flag, meaning n8n would evaluate workflow expressions within it and substitute attacker-controlled values at runtime. In multi-tenant or user-facing n8n deployments, a workflow author could wire a Webhook or other untrusted input node directly to the db_path field; when the workflow executes, the n8n process opens whichever file path the attacker supplies, enabling traversal outside the intended database directory. The fix (commit 145a887) adds noDataExpression: true to the db_path parameter definition, preventing expression evaluation; the v2 node architecture additionally moves the database path into a server-side credential (sqliteCredentialsApi) that is never controllable by workflow input data (GitHub Advisory, Fix Commit).

Successful exploitation allows a remote attacker to redirect the SQLite node to open arbitrary files accessible to the n8n process, enabling unauthorized reading of sensitive files (e.g., configuration files, credentials, other databases), creation of new SQLite files at arbitrary paths, or overwriting existing files — impacting confidentiality, integrity, and availability of data on the host. The risk is highest in multi-tenant or user-facing n8n deployments where workflow authors may inadvertently or maliciously wire untrusted external input to the db_path parameter; standalone deployments with only trusted workflow authors are not meaningfully affected (GitHub Advisory, Security Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the advisory publication date. Exploitation requires a specific precondition: a workflow author must have explicitly mapped untrusted input (e.g., from a Webhook node) to the db_path parameter, meaning the attack surface is limited to misconfigured multi-tenant deployments. No threat actor attribution, CISA KEV listing, or EPSS score data is currently available for this CVE (GitHub Advisory).

1. Identify a vulnerable deployment: Locate a multi-tenant or user-facing n8n instance running n8n-nodes-sqlite3 version < 1.0.0 where a workflow has been configured to accept external input (e.g., via a Webhook node).
2. Confirm db_path is wired to untrusted input: Verify (or social-engineer a workflow author into creating) a workflow where the db_path parameter of the SQLite node is set to an n8n expression referencing upstream data, such as {{ $json["path"] }}.
3. Craft a malicious request: Send an HTTP request to the n8n Webhook endpoint with a JSON body containing a path traversal payload, e.g., {"path": "../../etc/passwd"} or {"path": "/home/n8n/.n8n/config"}.
4. Trigger workflow execution: The n8n workflow evaluates the expression, substituting the attacker-controlled path into db_path, and the SQLite library opens (or creates/overwrites) the specified file.
5. Retrieve or manipulate file contents: Depending on the workflow's subsequent nodes (e.g., a Respond to Webhook node returning query results), the attacker may read file contents returned as SQLite data, or cause file corruption/overwrite by executing write operations against the redirected path (GitHub Advisory, Fix Commit).

• Logs: n8n execution logs showing SQLite node executions with db_path values containing ../, absolute paths outside the expected database directory, or paths referencing sensitive system files (e.g., /etc/passwd, .n8n/config).
• File System: Unexpected new SQLite files created in directories outside the intended database location; modification timestamps on sensitive files coinciding with n8n workflow execution times.
• Network: Unusual or repeated HTTP POST requests to n8n Webhook endpoints with JSON bodies containing file path strings or path traversal sequences (../, ..\).
• Process: The n8n Node.js process opening file descriptors to unexpected paths, observable via lsof or /proc/<pid>/fd on Linux systems.

Upgrade n8n-nodes-sqlite3 to version 1.0.0 or later, which resolves the vulnerability in two ways: the v1 node adds noDataExpression: true to the db_path parameter (commit 145a887), and the new v2 node architecture moves the database path into a server-side credential that cannot be influenced by workflow input data. As an interim workaround for deployments that cannot upgrade immediately, audit all workflows using the SQLite node and ensure the db_path parameter is set to a static value rather than an n8n expression referencing external input. Multi-tenant deployments should restrict which users can author or modify workflows containing the SQLite node (GitHub Advisory, Fix Commit, PR #25).