CVE-2026-77846

Name of the Vulnerable Software and Affected Versions ash sqlite versions 0.1.2-rc.0 through 0.2.17

Description Improper neutralization of special elements in data query logic allows an attacker to traverse into nested JSON data that the application did not intend to expose, potentially disclosing private or sensitive embedded fields. This occurs because AshSqlite.SqlImplementation constructs the SQLite json extract path by joining segments with dots. If a segment contains special characters such as ., [, ], or $, it re-interprets the JSON path, allowing access to deeper levels of the JSON structure. This issue is triggered when untrusted user input reaches a get path/2 segment, typically in patterns where users can select specific fields from a JSON or map column.

Recommendations Update ash sqlite to version 0.2.18 or later.