CVE-2026-54687

Name of the Vulnerable Software and Affected Versions n8n-nodes-sqlite3 versions prior to 1.0.0

Description The nodes/SqliteNode/v1/SqliteV1.node.ts file exposes the db path parameter, which allows data expressions from upstream workflow input. If a workflow author maps untrusted input to this parameter, a remote attacker can control which SQLite file the process opens. This enables path traversal, allowing the attacker to read, create, or overwrite files accessible to the n8n process. This issue is particularly risky in multi-tenant or user-facing deployments where untrusted users can influence workflow configuration.

Recommendations Update n8n-nodes-sqlite3 to version 1.0.0.