Executive brief
The n8n-nodes-sqlite3 library is a workflow integration node that allows automation platforms to query SQLite databases. Prior to version 1.0.0, the database file path was exposed as a user-editable workflow parameter, allowing an attacker to redirect file access to sensitive system files if a workflow author accidentally connected untrusted input to this field. In multi-tenant or user-facing n8n deployments, this could lead to unauthorized file reads or overwrites. The risk is lower in standalone deployments with only trusted workflow authors.
Technical details
The vulnerability is a path traversal (CWE-22) in the SQLite node's db_path parameter. In affected versions, the database file path was exposed as a direct node parameter visible and editable within workflow definitions, without server-side validation or restriction. An attacker could exploit this if a workflow author explicitly wired untrusted input (e.g., user-supplied data) to the db_path field, allowing arbitrary file access via path traversal (e.g., "../../../etc/passwd"). The attack requires the workflow author to introduce the vulnerability by routing untrusted input to this parameter; standalone deployments with only trusted workflow authors are not at risk. Fixed in v1.0.0 by moving the database path into a v2 node architecture credential stored server-side and not controllable by workflow input data.
Affected products
- DangerBlack n8n-nodes-sqlite3 < 1.0.0
Timeline
- 2026-06-26: disclosed: Published to GitHub Advisory Database (updated 2026-08-27)
- 2026-01-01: patched: Fixed in version 1.0.0 via commit 145a887; credential-based path introduced in v2 node architecture