n8n-nodes-sqlite3 exposed the database file path as a workflow parameter, giving path traversal in multi-tenant deployments

GitHub Advisory Database·medium signalXBlueskyLinkedInCopy link

GHSA-q7m3-rhxg-7vxr, published 27 August, covers versions of the n8n SQLite node before 1.0.0 that accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted input to db_path let an attacker control which file SQLite opened, reading or overwriting any file reachable by the n8n process. CVSS 6.1; the fix in v1.0.0 moves the path into a credential on a v2 node, which is the general pattern worth checking in any agent workflow platform, that a path or connection string presented as an editable parameter is an editable parameter.