CVE-2026-77846: AshSqlite JSON Path Injection Vulnerability
Summary
CVE-2026-77846: JSON path injection via unescaped get_path segments in AshSqlite. Affects ash_sqlite across 2 version ranges.
>= 0.1.2-rc.0, < 0.2.18
>= c12be48a5b6295593199b0e445b70a4aef81d1cd, < 2138480fceb654bec1845e691517ac409d0232c3
Fixed in 0.2.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshSqlite is a package within the Ash framework that provides an interface for SQLite databases, allowing developers to interact with JSON data stored in SQLite. It enables users to perform complex queries and manipulations on JSON data. However, the package has a vulnerability that allows attackers to exploit improperly handled JSON path segments, potentially exposing sensitive data.
Vulnerability Detail
The vulnerability arises from improper neutralization of special elements in data query logic within AshSqlite. Specifically, when user input reaches the get_path/2 segment, an attacker can manipulate the input to traverse into nested JSON structures that the application was not designed to expose. This can lead to unauthorized access to private or sensitive embedded fields. The vulnerability is particularly concerning because it allows for data exposure without direct SQL injection, as the path is treated as a parameter within the JSON-path grammar.
How To Fix
Minimum fixed version
0.2.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any user input reaching the get_path segment is properly sanitized and validated to prevent the inclusion of special characters such as '.', '[', ']', or '$'. This can be done by implementing input validation logic in your application code.
Conclusion
CVE-2026-77846 is a significant vulnerability in the AshSqlite package that can lead to unauthorized access to sensitive data through JSON path injection. It is crucial for developers using this package to update to the latest version and implement proper input validation to safeguard their applications.
See every vulnerability recorded for ash_sqlite →
FAQ
CVE-2026-77846 is a vulnerability in the AshSqlite package that allows for JSON path injection, potentially exposing sensitive data.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities in real-time.
The vulnerability affects AshSqlite versions from 0.1.2-rc.0 up to, but not including, 0.2.18.
If you cannot update the package immediately, implement input validation to sanitize user inputs reaching the get_path segment to mitigate the risk of exploitation.
The CVSS score for this vulnerability is 2.1, indicating a low severity level.
