1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (100.0%)
- Low0 (0.0%)
n8n-nodes-sqlite3
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting n8n-nodes-sqlite3, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-q7m3-rhxg-7vxr | Moderate | n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)## Affected versions < 1.0.0 ## Patched version 1.0.0 ## Description In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the db_path field could allow an attacker to control which file was opened by SQLite, potentially enabling path traversal to read or overwrite arbitrary files accessible to the n8n process. The vulnerability requires the workflow author to explicitly wire untrusted input to the db_path parameter, so it does not affect standalone dep |
| GitHub (opens in a new tab) |
- GHSA-q7m3-rhxg-7vxrModeraten8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)
< 1.0.0
## Affected versions < 1.0.0 ## Patched version 1.0.0 ## Description In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the db_path field could allow an attacker to control which file was opened by SQLite, potentially enabling path traversal to read or overwrite arbitrary files accessible to the n8n process. The vulnerability requires the workflow author to explicitly wire untrusted input to the db_path parameter, so it does not affect standalone dep
CVE: CVE-2026-54687