CVE-2026-77846: JSON path injection via unescaped get_path segments in AshSqlite

Q: Which deployments are realistically exposed?

Deployments are exposed if an endpoint allows attacker-controlled input to reach a get_path/2 segment, such as a user-selectable field or “pick-a-field” feature. The affected version range is ash_sqlite 0.1.2-rc.0 through versions before 0.2.18.

Q: What must an attacker supply to exploit this issue?

The attacker needs control over a get_path/2 segment and must include JSON-path metacharacters such as a period, brackets, or a dollar sign. A value such as "private.secret" can be interpreted as traversal into nested JSON fields rather than as one literal key.

Q: Does exploitation result in SQL injection?

No. The generated JSON path is bound as a parameter, so the issue is limited to SQLite JSON-path interpretation rather than arbitrary SQL execution. The stated impact is disclosure of nested embedded fields that the application did not intend to expose.

Published Aug 30, 2026

Updated

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsqlite allows an attacker who controls a getpath/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields.

AshSqlite.SqlImplementation builds the SQLite jsonextract path with "$." <> Enum.join(right, "."), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example "private.secret" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a getpath segment (a common pick-a-field pattern) can read nested values it never meant to expose.

This issue affects ashsqlite: from 0.1.2-rc.0 before 0.2.18.

Affected Software

1 affected component

ash-project/ash_sqlite>=0.1.2-rc.0<0.2.18

Event History

Aug 30, 2026

CVE Published

via MITRE·02:52 AM

Data Sourced

via MITRE·02:52 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are realistically exposed?

Deployments are exposed if an endpoint allows attacker-controlled input to reach a get_path/2 segment, such as a user-selectable field or “pick-a-field” feature. The affected version range is ash_sqlite 0.1.2-rc.0 through versions before 0.2.18.

What must an attacker supply to exploit this issue?

The attacker needs control over a get_path/2 segment and must include JSON-path metacharacters such as a period, brackets, or a dollar sign. A value such as "private.secret" can be interpreted as traversal into nested JSON fields rather than as one literal key.

Does exploitation result in SQL injection?

No. The generated JSON path is bound as a parameter, so the issue is limited to SQLite JSON-path interpretation rather than arbitrary SQL execution. The stated impact is disclosure of nested embedded fields that the application did not intend to expose.

CVE-2026-77846: JSON path injection via unescaped get_path segments in AshSqlite

Affected Software

Event History

Frequently Asked Questions

Which deployments are realistically exposed?

What must an attacker supply to exploit this issue?

Does exploitation result in SQL injection?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed?

What must an attacker supply to exploit this issue?

Does exploitation result in SQL injection?