# CVE-2026-78691: ash-project ash_sql LIKE wildcard injection in string search

Source: https://junglewise.ai/threats/cve-2026-78691-ash-project-ash-sql-like-wildcard-injection-in-string-search  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78691 · Severity: info · CVSS 0 · Published 2026-08-30

AshSQL is a data querying library used in Elixir applications to filter and search records. A flaw in its string search functions (contains, string_starts_with, string_ends_with) allows attackers to inject SQL LIKE wildcards by providing specially crafted search terms. This enables attackers to broaden search results beyond intended matches, bypass access controls, or crash queries—potentially exposing sensitive data or disrupting application availability.

Technologies: [Ash-Project Ash Sql](https://junglewise.ai/threats/technologies/ash-sql). Vendors: [Ash-Project](https://junglewise.ai/threats/vendors/ash-project).

## Quick answers

**Is CVE-2026-78691 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78691 being exploited in the wild.

**How severe is CVE-2026-78691?** Informational severity, with a CVSS score of 0, published 30 August 2026.

**Which products and versions are affected?** Ash-Project Ash Sql 0.1.1-rc.10 through 0.7.0.

**Is there a fix for CVE-2026-78691?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78691 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-78691?** Check whether you run Ash-Project Ash Sql at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper neutralization of special elements in SQL LIKE query logic (CWE-89 variant). AshSQL's escape helpers prefix % and _ with backslashes to neutralize them in LIKE patterns, but they fail to escape backslashes already present in user input. Since backslash is the default LIKE escape character, an attacker-supplied backslash negates the escaping mechanism: input \% becomes the pattern \\%, where \\ is a literal backslash and % remains an active wildcard. The search value remains parameterized (preventing full SQL injection), but the attacker gains pattern-matching control. Attack vectors include widening search matches to probe database contents, bypassing negated contains() guards, or crashing queries with a trailing lone backslash. This affects ash_sql versions 0.1.1-rc.10 through 0.7.0; the issue is network-reachable if the application exposes search APIs to unauthenticated users.

## Affected products

- ash-project ash_sql 0.1.1-rc.10 through 0.7.0

## Timeline

- 2026-08-30: disclosed

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)

## Related threats

- [ash-project ash_sql authorization bypass in aggregates](https://junglewise.ai/threats/cve-2026-81318-ash-project-ash-sql-authorization-bypass-in-aggregates)
- [ash-project ash_sql incorrect authorization in aggregate queries](https://junglewise.ai/threats/cve-2026-81316-ash-project-ash-sql-incorrect-authorization-in-aggregate-queries)
- [ash-project ash_sql string trim incorrect comparison](https://junglewise.ai/threats/cve-2026-80227-ash-project-ash-sql-string-trim-incorrect-comparison)
- [ash-project ash_sql authorization bypass in exists filter](https://junglewise.ai/threats/cve-2026-77454-ash-project-ash-sql-authorization-bypass-in-exists-filter)