{"id":"CVE-2026-77846","aliases":["EEF-CVE-2026-77846","EUVD-2026-68147","GHSA-hrp2-5hgw-c83c"],"status":"published","title":"JSON path injection via unescaped get_path segments in AshSqlite","description":"Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields.\n\nAshSqlite.SqlImplementation builds the SQLite json_extract path with \"$.\" \u003c\u003e Enum.join(right, \".\"), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example \"private.secret\" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose.\n\nThis issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.","severity":{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00197,"percentile":0.09482,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-943"],"published":"2026-08-30T02:52:12Z","modified":"2026-10-28T02:31:00Z","fixes":[{"ecosystem":"Hex","package":"ash_sqlite","fixed_in":["0.2.18"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Hex","package":"ash_sqlite","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.2-rc.0"},{"fixed":"0.2.18"}]}],"versions":["0.1.2","0.1.2-rc.0","0.1.2-rc.1","0.1.3","0.2.0","0.2.1","0.2.10","0.2.11","0.2.12","0.2.13","0.2.14","0.2.15","0.2.16","0.2.17","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.2.8","0.2.9"]}],"products":[{"vendor":"ash-project","product":"ash_sqlite"}],"references":[{"url":"https://github.com/ash-project/ash_sqlite/security/advisories/GHSA-hrp2-5hgw-c83c","tags":["vendor-advisory","related","exploit","advisory"]},{"url":"https://cna.erlef.org/cves/CVE-2026-77846.html","tags":["related","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-77846","tags":["related","web"]},{"url":"https://github.com/ash-project/ash_sqlite/commit/2138480fceb654bec1845e691517ac409d0232c3","tags":["patch","fix"]},{"url":"https://github.com","tags":["web"]},{"url":"https://repo.hex.pm","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77846.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77846","tags":["advisory"]},{"url":"https://github.com/ash-project/ash_sqlite","tags":["package"]},{"url":"https://hex.pm/packages/ash_sqlite","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-77846","title":"JSON path injection via unescaped get_path segments in AshSqlite","description":"Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields.\n\nAshSqlite.SqlImplementation builds the SQLite json_extract path with \"$.\" \u003c\u003e Enum.join(right, \".\"), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example \"private.secret\" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose.\n\nThis issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.","status":"published","published":"2026-08-30T02:52:12.562Z","modified":"2026-08-31T14:54:22.261Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T14:20:15.712761Z"}],"euvd":[{"id":"EUVD-2026-68147","description":"Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields.\n\nAshSqlite.SqlImplementation builds the SQLite json_extract path with \"$.\" \u003c\u003e Enum.join(right, \".\"), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example \"private.secret\" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose.\n\nThis issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.","status":"published","published":"2026-08-30T02:52:12Z","modified":"2026-08-31T14:54:22Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T18:01:21.100116Z"}],"nvd":[{"id":"CVE-2026-77846","description":"Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields.\n\nAshSqlite.SqlImplementation builds the SQLite json_extract path with \"$.\" \u003c\u003e Enum.join(right, \".\"), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example \"private.secret\" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose.\n\nThis issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.","status":"published","published":"2026-08-30T03:16:32.53Z","modified":"2026-09-01T21:15:00.147Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T14:12:42.691315Z"}],"osv":[{"id":"CVE-2026-77846","title":"JSON path injection via unescaped get_path segments in AshSqlite","description":"Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields.\n\nAshSqlite.SqlImplementation builds the SQLite json_extract path with \"$.\" \u003c\u003e Enum.join(right, \".\"), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example \"private.secret\" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose.\n\nThis issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.","status":"published","published":"2026-08-30T02:52:12.562Z","modified":"2026-10-28T02:31:00.885199745Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T15:45:17.44708Z"},{"id":"EEF-CVE-2026-77846","title":"JSON path injection via unescaped get_path segments in AshSqlite","description":"## Summary\n\nImproper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a `get_path/2` segment to traverse into nested JSON the application never exposed, disclosing private or `sensitive?` embedded fields.\n\n`AshSqlite.SqlImplementation` builds the SQLite `json_extract` path with `\"$.\" \u003c\u003e Enum.join(right, \".\")`, so a single segment containing `.`, `[`, `]`, or `$` re-interprets the JSON path (for example `\"private.secret\"` descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a `get_path` segment (a common pick-a-field pattern) can read nested values it never meant to expose.\n\nThis issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.\n\n## Configurations\n\nAn application must let untrusted input reach a `get_path/2` path segment over a JSON/map column (for example a public calculation or filter argument that selects a key).","status":"published","published":"2026-08-30T02:52:12.562Z","modified":"2026-09-08T03:45:03.421886293Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-943"],"updated_at":"2026-11-02T15:46:33.520522Z"}]}}