In-app reader
< 1.0.0
1.0.0
In versions prior to 1.0.0, the SQLite node accepted the database file
path as a direct node parameter visible and editable in the workflow.
A workflow author who mapped untrusted user input to the db_path field
could allow an attacker to control which file was opened by SQLite,
potentially enabling path traversal to read or overwrite arbitrary
files accessible to the n8n process.
The vulnerability requires the workflow author to explicitly wire
untrusted input to the db_path parameter, so it does not affect
standalone deployments where only trusted users author workflows.
However, in multi-tenant or user-facing n8n deployments the risk
is elevated.
Fixed in v1.0.0 by moving the database path into a credential
(v2 node architecture), which is stored server-side and not
controllable by workflow input data.
Fix commit: 145a887
Introduced credential-based path: v2 node
dyingman1 (role: Reporter)
Discussion
Sign in to join the discussion.
Keep reading
Optional: create a free account to save items, track programs, and sync across web + app. Reading stays free.