CVE-2026-54687 DangerBlack CVE debrief

Who should care

Defenders responsible for n8n workflows and deployments should assess exposure and verify the version of n8n-nodes-sqlite3 in use. They should also restrict untrusted input to the db_path parameter to prevent potential file system access and data tampering. Additionally, defenders should review compensating controls for exposed systems and monitor for potential file system access attempts.

Why it matters

Defenders should prioritize verifying and upgrading to version 1.0.0 of n8n-nodes-sqlite3, and restrict untrusted input to the db_path parameter to prevent potential file system access and data tampering.

• Potential unauthorized file system access
• Possible data tampering or theft
• Required verification of input validation and sanitization
• Necessary upgrade to version 1.0.0 of n8n-nodes-sqlite3

Technical summary

The n8n-nodes-sqlite3 node exposes the db_path database file path as a node parameter, allowing data expressions from upstream workflow input. A workflow author who maps untrusted input to db_path can allow a remote attacker to select which SQLite file the n8n process opens, potentially reading, creating, or overwriting files accessible to the process. This issue is fixed in version 1.0.0. Defenders should prioritize verifying and upgrading to version 1.0.0 of n8n-nodes-sqlite3, and restrict untrusted input to the db_path parameter.

Defensive priority

Defenders should prioritize verifying and upgrading to version 1.0.0 of n8n-nodes-sqlite3, and restrict untrusted input to the db_path parameter.

Recommended defensive actions

• Verify and upgrade to version 1.0.0 of n8n-nodes-sqlite3
• Restrict untrusted input to the db_path parameter
• Monitor for potential file system access attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and potential impact require further verification. The vulnerability is caused by the exposure of the db_path parameter, which allows remote attackers to manipulate the SQLite file path. Defenders should verify the version of n8n-nodes-sqlite3 and restrict untrusted input to the db_path parameter to prevent potential file system access and data tampering.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.