Critical AshSqlite Vulnerability (CVE-2026-77846) Exposes Hidden JSON Data in Database Queries On August 30, 2026, the Erlang Ecosystem Foundation’s CNA disclosed CVE-2026-77846, a JSONPath injection vulnerability in AshSqlite, a SQLite integration layer for the Ash Framework. The flaw allows attackers to traverse nested JSON structures and access sensitive or hidden fields in database records by manipulating untrusted input in field-selection requests. ### Key Details - Affected Versions: AshSqlite 0.1.2-rc.0 through 0.2.17 (patched in 0.2.18). - Root Cause: Unsafe construction of JSON paths, where attacker-controlled input (e.g., dots, brackets, or JSONPath symbols) could alter path interpretation, exposing nested data unintended for public access. - Exploitation Vector: Attackers exploit the flaw via public APIs, search filters, or field-selection endpoints that accept untrusted input. A proof-of-concept (PoC) demonstrated how a single malicious path segment could leak nested values (e.g., `{"private": {"secret": "api-key"}}`). - Impact: Systems processing untrusted input (e.g., public-facing applications) are at higher risk, while internal applications with trusted callers face lower exposure. The vulnerability does not involve SQL injection but abuses SQLite’s JSON path handling. ### Mitigation & Fixes - Patch: Upgrade to AshSqlite 0.2.18 or later, which replaces unsafe path joining with secure encoding, escaping backslashes/quotes, and separate handling of numeric array indexes. - Temporary Workarounds: Restrict dynamic field-selection input, audit logs for unusual JSONPath characters (e.g., dots, brackets), and review dependency locks for older versions. - Detection: Monitor for malformed input (e.g., unbalanced brackets) or SQLite JSON path errors, which may indicate exploitation attempts. The vulnerability underscores the risks of improper input validation in JSON path processing, particularly in applications handling sensitive data. Organizations using AshSqlite should prioritize upgrades and audits of affected systems.