CVE-2026-77846: JSON path injection via unescaped get_path segments in AshSqlite

Severity: low (CVSS 2.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-30 · updated 2026-09-01
Weakness: CWE-943

Description

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation builds the SQLite json_extract path with "$." <> Enum.join(right, "."), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example "private.secret" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose. This issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.

Affected products

ash-project ash_sqlite: from 0.1.2-rc.0 before 0.2.18 — fixed in 0.2.18

How to fix

Upgrade to a fixed version: ash-project ash_sqlite 0.2.18. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-77846 or the next vulnerability affects your stack