CVE-2026-54687

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54687

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54687.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54687

Aliases

GHSA-q7m3-rhxg-7vxr

Published

2026-08-27T17:06:40.278Z

Modified

2026-08-30T03:30:54.429239194Z

Severity

6.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

n8n-nodes-sqlite3: Path traversal via user-controlled database file path (db_path parameter)

Details

n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the dbpath database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to dbpath can allow a remote attacker to select which SQLite file the n8n process opens, enabling traversal outside the intended database location and potentially reading, creating, or overwriting files accessible to the process. This issue is fixed in version 1.0.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54687.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "1.0.0"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/dangerblack/n8n-node-sqlite3

Affected ranges

Type

GIT

Repo

https://github.com/dangerblack/n8n-node-sqlite3

Events

Introduced

Fixed

145a8876ff12375813bdcd4ae4fe78f460c53a98

Database specific

Show details

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54687.json"