CVE-2026-78691

Name of the Vulnerable Software and Affected Versions ash sql versions 0.1.1-rc.10 through 0.7.0

Description Improper neutralization of special elements in data query logic allows a user to inject live SQL LIKE wildcards when providing search terms to the contains/2, string starts with/2, or string ends with/2 functions. This occurs because the escape helpers in AshSql.Expr prefix % and with a backslash but fail to escape backslashes already present in the input. Since the backslash is the default LIKE escape character, an input of % results in the pattern %, where the first backslash is treated as a literal and the % remains an active wildcard. While the search value remains parameterized, preventing full SQL injection, an attacker can use this to widen matches to probe values, bypass negated contains(...) guards, or cause the query to crash using a trailing lone backslash.

Recommendations Update ash sql to version 0.7.1 or later.