Executive brief
AshSQL is a data querying library used in Elixir applications to filter and search records. A flaw in its string search functions (contains, string_starts_with, string_ends_with) allows attackers to inject SQL LIKE wildcards by providing specially crafted search terms. This enables attackers to broaden search results beyond intended matches, bypass access controls, or crash queries—potentially exposing sensitive data or disrupting application availability.
Technical details
The vulnerability is an improper neutralization of special elements in SQL LIKE query logic (CWE-89 variant). AshSQL's escape helpers prefix % and _ with backslashes to neutralize them in LIKE patterns, but they fail to escape backslashes already present in user input. Since backslash is the default LIKE escape character, an attacker-supplied backslash negates the escaping mechanism: input \% becomes the pattern \\%, where \\ is a literal backslash and % remains an active wildcard. The search value remains parameterized (preventing full SQL injection), but the attacker gains pattern-matching control. Attack vectors include widening search matches to probe database contents, bypassing negated contains() guards, or crashing queries with a trailing lone backslash. This affects ash_sql versions 0.1.1-rc.10 through 0.7.0; the issue is network-reachable if the application exposes search APIs to unauthenticated users.
Affected products
- ash-project ash_sql 0.1.1-rc.10 through 0.7.0
Timeline
- 2026-08-30: disclosed