Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| n8n-nodes-sqlite3 | npm | < 1.0.0 | 1.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-54687, describes a path traversal issue in the n8n-nodes-sqlite3 package, specifically within the SqliteV1 node. The core of the vulnerability lies in the db_path parameter, which, prior to version 1.0.0, allowed data expressions from untrusted input. This meant that an attacker could manipulate the db_path to point to arbitrary file locations on the system, leading to unauthorized file access (read, create, overwrite). The provided patch (commit 145a8876ff12375813bdcd4ae4fe78f460c53a98) directly addresses this by adding noDataExpression: true to the db_path parameter's definition in nodes/SqliteNode/v1/SqliteV1.node.ts. This change prevents the db_path from being controlled by dynamic data expressions, thereby mitigating the path traversal risk. While the patch itself only shows the parameter definition change, the vulnerability manifests when the SqliteV1 node's execution logic (typically within a method like execute or run) attempts to open a database using the user-controlled db_path. Therefore, the SqliteV1 class and its primary execution method are identified as the vulnerable components, as this is where the malicious db_path would be processed. The exact method name execute is inferred as a common pattern for n8n node execution, but the vulnerability is tied to the processing of db_path within the SqliteV1 node.
SqliteV1.executenodes/SqliteNode/v1/SqliteV1.node.ts