{"id":"GHSA-mqjf-5f49-2fjh","summary":"GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers","details":"### Summary\n\nAn SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:\n\n* `jsonArrayContains` function  \n    Requires PostGIS 12 or greater with a String or JSON field\n\nFor PostGIS 12 and greater `jsonArrayContains(\u003ccolumn\u003e, \u003cpointer\u003e, \u003cvalue\u003e)` function writes `\u003cvalue\u003e` into generated SQL without escaping.\n\n### Patches\n\n* GeoTools 35.1\n* GeoTools 33.5\n* GeoTools 34.4\n\n### Mitigation\n\nNo mitigation is available:\n\n* To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.\n\n### Impact\n\nThis vulnerability can lead to execution of arbitrary SQL expressions in the database.\n\n### References\n\n* https://osgeo-org.atlassian.net/browse/GEOT-7958\n* https://osgeo-org.atlassian.net/browse/GEOT-7959\n* https://github.com/geotools/geotools/pull/5829\n* https://osgeo-org.atlassian.net/browse/GEOT-7589","aliases":["CVE-2026-76904"],"modified":"2026-08-21T20:40:58.371279Z","published":"2026-08-21T20:25:41Z","database_specific":{"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2026-08-21T20:25:41Z","nvd_published_at":null,"cwe_ids":["CWE-89"]},"references":[{"type":"WEB","url":"https://github.com/geotools/geotools/security/advisories/GHSA-mqjf-5f49-2fjh"},{"type":"WEB","url":"https://github.com/geotools/geotools/pull/5829"},{"type":"WEB","url":"https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176"},{"type":"PACKAGE","url":"https://github.com/geotools/geotools"},{"type":"WEB","url":"https://github.com/geotools/geotools/releases/tag/33.6"},{"type":"WEB","url":"https://github.com/geotools/geotools/releases/tag/34.5"},{"type":"WEB","url":"https://github.com/geotools/geotools/releases/tag/35.1"},{"type":"WEB","url":"https://osgeo-org.atlassian.net/browse/GEOT-7589"},{"type":"WEB","url":"https://osgeo-org.atlassian.net/browse/GEOT-7958"},{"type":"WEB","url":"https://osgeo-org.atlassian.net/browse/GEOT-7959"}],"affected":[{"package":{"name":"org.geotools.jdbc:gt-jdbc-postgis","ecosystem":"Maven","purl":"pkg:maven/org.geotools.jdbc/gt-jdbc-postgis"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"35.0"},{"fixed":"35.1"}]}],"versions":["35.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-mqjf-5f49-2fjh/GHSA-mqjf-5f49-2fjh.json"}},{"package":{"name":"org.geotools.jdbc:gt-jdbc-postgis","ecosystem":"Maven","purl":"pkg:maven/org.geotools.jdbc/gt-jdbc-postgis"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"34.0"},{"fixed":"34.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-mqjf-5f49-2fjh/GHSA-mqjf-5f49-2fjh.json"}},{"package":{"name":"org.geotools.jdbc:gt-jdbc-postgis","ecosystem":"Maven","purl":"pkg:maven/org.geotools.jdbc/gt-jdbc-postgis"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"30.5"},{"fixed":"33.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-mqjf-5f49-2fjh/GHSA-mqjf-5f49-2fjh.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}