CVE-2026-77846: ash-project ash_sqlite JSON path traversal in get_path

Executive brief

AshSqlite is a library that integrates SQLite database functionality with the Ash framework. A flaw in how it constructs JSON path queries allows attackers who can control input field names to access nested JSON data that the application never intended to expose, potentially revealing sensitive or private information embedded in database records.

Technical details

The vulnerability is an improper neutralization of special characters in JSON path logic (CWE-89 equivalent for JSON contexts). The AshSqlite.SqlImplementation constructs SQLite json_extract paths by concatenating user-supplied get_path segments with dots, without sanitizing special JSON path characters (`.`, `[`, `]`, ` ). Although the path is bound as a parameter (preventing SQL injection), these characters are interpreted within the JSON path grammar itself, allowing traversal to unintended nested keys. Any endpoint accepting user input that reaches a get_path segment—a common pattern for field selection—can be exploited. The issue affects ash_sqlite versions from 0.1.2-rc.0 through 0.2.17; version 0.2.18 and later contain the fix.

Affected products

• ash-project ash_sqlite 0.1.2-rc.0 to 0.2.17

Timeline

• 2026-08-30: disclosed

References

• https://repo.hex.pm/
• https://github.com/