EEF-CVE-2026-77846
JSON path injection via unescaped get_path segments in AshSqlite
Quick fix
EEF-CVE-2026-77846 — ash_sqlite: upgrade to the fixed version with the command below.
mix deps.update ash_sqliteDetails
## Summary
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash\_sqlite allows an attacker who controls a get\_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields.
AshSqlite.SqlImplementation builds the SQLite json\_extract path with "$." <> Enum.join(right, "."), so a single segment containing ., \[, \], or $ re-interprets the JSON path (for example "private.secret" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get\_path segment (a common pick-a-field pattern) can read nested values it never meant to expose.
This issue affects ash\_sqlite: from 0.1.2-rc.0 before 0.2.18.
## Configuration
An application must let untrusted input reach a get\_path/2 path segment over a JSON/map column (for example a public calculation or filter argument that selects a key).
Are you affected?
Enter the version of the package you're using.