Description
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields.

AshSqlite.SqlImplementation builds the SQLite json_extract path with "$." <> Enum.join(right, "."), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example "private.secret" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose.

This issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.
Published: 2026-08-30
Score: 2.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

An attacker controlling a get_path/2 segment can inject characters that the library interprets as JSON traversal syntax, allowing the application to read nested JSON fields that were never intended for exposure. The flaw is an improper neutralization of special elements in data query logic, identified as CWE‑943, and results in information disclosure of private or sensitive stored values.

Affected Systems

The vulnerability is in AshProject’s ash_sqlite library, affecting all releases from 0.1.2‑rc.0 up through 0.2.17, inclusive. Any application that uses a version prior to 0.2.18 and that exposes an endpoint where a user can supply the get_path segment is at risk. The affected product is AshProject ash_sqlite.

Risk and Exploitability

The CVSS score of 2.1 classifies this issue as low severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog. Because the path parameter is bound as a separate argument in SQLite, exploitation can be achieved by sending a crafted JSON path value to any exposed API, making the vulnerability easily exploitable in services that refuse to validate or sanitize the input.

Generated by OpenCVE AI on August 30, 2026 at 05:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ash_sqlite to version 0.2.18 or later.
  • Validate user‑supplied get_path segments and reject any that contain characters such as ".", "[", "]", or "$" to prevent JSON path traversal.
  • Review API endpoints that accept get_path input, restrict their exposure to trusted users, and enforce proper authentication and authorization before allowing such access.

Generated by OpenCVE AI on August 30, 2026 at 05:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 30 Aug 2026 03:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation builds the SQLite json_extract path with "$." <> Enum.join(right, "."), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example "private.secret" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose. This issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.
Title JSON path injection via unescaped get_path segments in AshSqlite
First Time appeared Ash-project
Ash-project ash Sqlite
Weaknesses CWE-943
CPEs cpe:2.3:a:ash-project:ash_sqlite:*:*:*:*:*:*:*:*
Vendors & Products Ash-project
Ash-project ash Sqlite
References
Metrics cvssV4_0

{'score': 2.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Ash-project Ash Sqlite
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-08-31T14:54:22.261Z

Reserved: 2026-08-30T02:15:01.493Z

Link: CVE-2026-77846

cve-icon Vulnrichment

Updated: 2026-08-31T14:54:18.474Z

cve-icon NVD

Status : Deferred

Published: 2026-08-30T03:16:32.530

Modified: 2026-09-01T21:15:00.147

Link: CVE-2026-77846

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T21:24:20Z

Weaknesses
  • CWE-943

    Improper Neutralization of Special Elements in Data Query Logic