AshSqlite.SqlImplementation builds the SQLite json_extract path with "$." <> Enum.join(right, "."), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example "private.secret" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose.
This issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ash-project | ash_sqlite | unaffected |
|
||||||
| ash-project | ash_sqlite | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 30 Aug 2026 03:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation builds the SQLite json_extract path with "$." <> Enum.join(right, "."), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example "private.secret" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose. This issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18. | |
| Title | JSON path injection via unescaped get_path segments in AshSqlite | |
| First Time appeared |
Ash-project
Ash-project ash Sqlite |
|
| Weaknesses | CWE-943 | |
| CPEs | cpe:2.3:a:ash-project:ash_sqlite:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Ash-project
Ash-project ash Sqlite |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: EEF
Published:
Updated: 2026-08-30T02:52:12.562Z
Reserved: 2026-08-30T02:15:01.493Z
Link: CVE-2026-77846
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-30T03:16:32.530
Modified: 2026-08-30T03:16:32.530
Link: CVE-2026-77846
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-30T05:30:06Z
-
CWE-943
Improper Neutralization of Special Elements in Data Query Logic