CVE-2026-77846
Received Received - Intake

Path Traversal in AshSqlite via JSON Path Manipulation

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: EEF

Description
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation builds the SQLite json_extract path with "$." <> Enum.join(right, "."), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example "private.secret" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose. This issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-77846
EUVD
EUVD-2026-68147

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ash-project ash_sqlite to 0.2.18 (exc)
ash-project ash_sqlite to 0.2.17 (inc)
ash-project ash_sqlite 0.2.18

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77846 is a JSON path injection vulnerability in the ash_sqlite library. It occurs when user-controlled input reaches the get_path/2 function, allowing attackers to manipulate JSON path segments with special characters like ., [, ], or $. This causes the application to traverse into nested JSON fields that were never meant to be exposed, potentially leaking sensitive data.

Detection Guidance

To detect this vulnerability, inspect applications using ash_sqlite versions 0.1.2-rc.0 to 0.2.17 for endpoints that accept user input for JSON path segments. Check if user input reaches the get_path/2 function without proper validation. Look for logs showing JSON path manipulation attempts with special characters like ., [, ], or $.

Impact Analysis

If you use ash_sqlite versions 0.1.2-rc.0 to 0.2.17, an attacker could exploit this to read private or sensitive fields in your JSON data by injecting path segments. This is possible if your application has endpoints that allow user input to influence a get_path segment, such as field selection mechanisms.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, which may violate GDPR, HIPAA, or other privacy regulations. Exposure of private fields could result in non-compliance with data protection requirements, potentially leading to legal or financial penalties.

Mitigation Strategies

Immediately upgrade ash_sqlite to version 0.2.18 or later to apply the patch. If upgrading is not possible, implement input validation to reject or escape special characters in path segments before they reach get_path/2. Review all endpoints that use get_path to ensure user input cannot influence path construction.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77846. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart