GeoTools, an open‑source Java geospatial library, contains an injection flaw in the jsonArrayContains function used by the PostGIS DataStore. When a filter expression is processed, the function writes the supplied <value> directly into the generated SQL without escaping, allowing an attacker to inject arbitrary SQL statements. This can enable unauthorized data reading, modification, or escalation of privileges within a PostGIS database, as the flaw resides in the core query generation used by the library.

The vulnerability affects GeoTools releases starting with version 30.5 and up through versions prior to 33.6, 34.5, and 35.1. Systems using those GeoTools versions together with a PostGIS 12 or newer database, and a column of type Text or JSON, are at risk. The attack requires that the GeoTools instance processes OGC filter requests that call jsonArrayContains on PostGIS data.

The CVSS score of 9.8 indicates a critical severity, and the EPSS score of 2% reflects the likelihood of exploitation. The flaw can be leveraged remotely via any HTTP or other interface that accepts OGC filters handled by GeoTools, and it can persist in a database setting, making it a persistent threat. The vulnerability is not listed in the CISA KEV catalog, but the absence of a KEV status does not diminish its exploitability. Attackers who can supply crafted JSONArrayContains arguments may gain elevated database access or exfiltrate sensitive geospatial data.