{"id":"CVE-2026-77846","summary":"JSON path injection via unescaped get_path segments in AshSqlite","details":"Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields.\n\nAshSqlite.SqlImplementation builds the SQLite json_extract path with \"$.\" \u003c\u003e Enum.join(right, \".\"), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example \"private.secret\" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose.\n\nThis issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.","aliases":["EEF-CVE-2026-77846","GHSA-hrp2-5hgw-c83c"],"modified":"2026-09-03T03:30:53.762766296Z","published":"2026-08-30T02:52:12.562Z","database_specific":{"cwe_ids":["CWE-943"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77846.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"c12be48a5b6295593199b0e445b70a4aef81d1cd"},{"fixed":"2138480fceb654bec1845e691517ac409d0232c3"}]}],"cna_assigner":"EEF"},"references":[{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-77846.html"},{"type":"WEB","url":"https://github.com"},{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-77846"},{"type":"WEB","url":"https://repo.hex.pm"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77846.json"},{"type":"ADVISORY","url":"https://github.com/ash-project/ash_sqlite/security/advisories/GHSA-hrp2-5hgw-c83c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77846"},{"type":"FIX","url":"https://github.com/ash-project/ash_sqlite/commit/2138480fceb654bec1845e691517ac409d0232c3"},{"type":"PACKAGE","url":"https://github.com/ash-project/ash_sqlite"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ash-project/ash_sqlite","events":[{"introduced":"26f94773c09ec7ef009bf0af8357a6f2c0ab2ad9"},{"fixed":"dd58c58689aa5575497e58dd63ebea0aba345d78"},{"fixed":"2138480fceb654bec1845e691517ac409d0232c3"}],"database_specific":{"extracted_events":[{"introduced":"0.1.2-rc.0"},{"fixed":"0.2.18"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v0.2.17","v0.2.16","v0.2.15","v0.2.14","v0.2.13","v0.2.12","v0.2.11","v0.2.10","v0.2.9","v0.2.7","v0.2.6","v0.2.5","v0.2.4","v0.2.3","v0.2.2","v0.2.1","v0.2.0","v0.1.3","v0.1.2","v0.1.2-rc.1","v0.1.2-rc.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77846.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}