GeoTools, an open‑source Java geospatial library, contains an injection flaw in the jsonArrayContains function used by the PostGIS DataStore. This is a CWE‑89 SQL injection vulnerability. When a filter expression is processed, the function writes the supplied value directly into the generated SQL without escaping, allowing an attacker to inject arbitrary SQL statements. This can enable unauthorized data reading, modification, or escalation of privileges within a PostGIS database, as the flaw resides in the core query generation used by the library.

The vulnerability affects GeoTools releases starting with version 30.5 and up through versions prior to 33.6 and 34.5. Systems using those GeoTools versions together with a PostGIS 12 or newer database, and a column of type Text or JSON, are at risk. The attack requires that the GeoTools instance processes OGC filter requests that call jsonArrayContains on PostGIS data.

The CVSS score of 9.8 indicates a critical severity, and the EPSS score of 4% reflects the likelihood of exploitation. The flaw could be leveraged remotely through any interface that accepts OGC filters processed by GeoTools; the most likely attack vector is inferred from the description, as the vulnerability is triggered when processing filter requests. Attackers who can supply crafted jsonArrayContains arguments may gain elevated database access or exfiltrate sensitive geospatial data. The vulnerability is not listed in the CISA KEV catalog, but that absence does not diminish its exploitability.