CVE-2026-54687

The n8n-nodes-sqlite3 node (versions prior to 1.0.0 ) is vulnerable to a path traversal attack because the db_path parameter is exposed as a direct node parameter. If a workflow author maps untrusted input to this field, a remote attacker can control which SQLite file the n8n process opens. This ...

CVE-2026-54687 n8n-nodes-sqlite3: Path traversal via user-controlled database file path (db_path parameter)

n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the dbpath database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to dbpa...

EUVD-2026-67158

n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the dbpath database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to dbpa...

CVE-2026-54687 n8n-nodes-sqlite3: Path traversal via user-controlled database file path (db_path parameter)

n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the dbpath database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to dbpa...

CVE-2026-54687 n8n-nodes-sqlite3: Path traversal via user-controlled database file path (db_path parameter)

n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the dbpath database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to dbpa...

CVE-2026-54687: Improper Limitation of a Pathname to a Restricted Directory

n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the dbpath database file path as a node parameter that permits data expressions from upstream workflow input. A workflow author who maps untrusted input to dbpa...

PT-2026-82684

Name of the Vulnerable Software and Affected Versions n8n-nodes-sqlite3 versions prior to 1.0.0 Description The nodes/SqliteNode/v1/SqliteV1.node.ts file exposes the db path parameter, which allows data expressions from upstream workflow input. If a workflow author maps untrusted input to this...

ROOT-OS-DEBIAN-12-CVE-2026-11824 CVE-2026-11824 in sqlite3 - Patched by Root

Root has patched CVE-2026-11824 in the sqlite3 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-7709 CVE-2025-7709 in sqlite3 - Patched by Root

Root has patched CVE-2025-7709 in the sqlite3 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-11822 CVE-2026-11822 in sqlite3 - Patched by Root

Root has patched CVE-2026-11822 in the sqlite3 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-7458 CVE-2025-7458 in sqlite3 - Patched by Root

Root has patched CVE-2025-7458 in the sqlite3 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-29088 CVE-2025-29088 in sqlite3 - Patched by Root

Root has patched CVE-2025-29088 in the sqlite3 package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-11822 CVE-2026-11822 in sqlite3 - Patched by Root

Root has patched CVE-2026-11822 in the sqlite3 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-11824 CVE-2026-11824 in sqlite3 - Patched by Root

Root has patched CVE-2026-11824 in the sqlite3 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2025-6965 CVE-2025-6965 in sqlite3 - Patched by Root

Root has patched CVE-2025-6965 in the sqlite3 package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-11822 CVE-2026-11822 in sqlite3 - Patched by Root

Root has patched CVE-2026-11822 in the sqlite3 package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2025-29088 CVE-2025-29088 in sqlite3 - Patched by Root

Root has patched CVE-2025-29088 in the sqlite3 package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2022-35737 CVE-2022-35737 in sqlite3 - Patched by Root

Root has patched CVE-2022-35737 in the sqlite3 package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-11824 CVE-2026-11824 in sqlite3 - Patched by Root

Root has patched CVE-2026-11824 in the sqlite3 package for Root:Debian:11. Multiple fixed versions available...

PT-2026-73399

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3 reset directly, bypassing the...