Is CVE-2026-78691 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78691 being exploited in the wild.

How severe is CVE-2026-78691?

Informational severity, with a CVSS score of 0, published 30 August 2026.

Which products and versions are affected?

Ash-Project Ash Sql 0.1.1-rc.10 through 0.7.0.

Is there a fix for CVE-2026-78691?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-78691 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-78691?

Check whether you run Ash-Project Ash Sql at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78691: ash-project ash_sql LIKE wildcard injection in string search

CVE-2026-78691 · Severity: info · CVSS 0 · Published 2026-08-30

AshSQL is a data querying library used in Elixir applications to filter and search records. A flaw in its string search functions (contains, string_starts_with, string_ends_with) allows attackers to inject SQL LIKE wildcards by providing specially crafted search terms. This enables attackers to broaden search results beyond intended matches, bypass access controls, or crash queries—potentially exposing sensitive data or disrupting application availability.

Technologies: Ash-Project Ash Sql. Vendors: Ash-Project.

Quick answers

Is CVE-2026-78691 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78691 being exploited in the wild.
How severe is CVE-2026-78691?: Informational severity, with a CVSS score of 0, published 30 August 2026.
Which products and versions are affected?: Ash-Project Ash Sql 0.1.1-rc.10 through 0.7.0.
Is there a fix for CVE-2026-78691?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-78691 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-78691?: Check whether you run Ash-Project Ash Sql at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper neutralization of special elements in SQL LIKE query logic (CWE-89 variant). AshSQL's escape helpers prefix % and _ with backslashes to neutralize them in LIKE patterns, but they fail to escape backslashes already present in user input. Since backslash is the default LIKE escape character, an attacker-supplied backslash negates the escaping mechanism: input \% becomes the pattern \\%, where \\ is a literal backslash and % remains an active wildcard. The search value remains parameterized (preventing full SQL injection), but the attacker gains pattern-matching control. Attack vectors include widening search matches to probe database contents, bypassing negated contains() guards, or crashing queries with a trailing lone backslash. This affects ash_sql versions 0.1.1-rc.10 through 0.7.0; the issue is network-reachable if the application exposes search APIs to unauthenticated users.

Affected products

ash-project ash_sql 0.1.1-rc.10 through 0.7.0

Timeline

2026-08-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.