Critical AshSqlite Vulnerability Could Expose Hidden JSON Data (CVE-2026-77846)

A newly disclosed vulnerability in AshSqlite could allow attackers to access sensitive information hidden inside JSON data, potentially exposing fields that an application was never intended to make publicly available.

The security flaw, tracked as CVE-2026-77846, affects AshSqlite, the SQLite database layer used with the Ash Framework, a framework for building applications in Elixir.

The vulnerability was published on 30 August 2026 and involves the way AshSqlite constructs JSON paths when processing the get_path/2 function.

JSON path injection

CVE-2026-77846 is classified as an improper neutralisation of special elements in data query logic.

Importantly, the vulnerability is not traditional SQL injection.

Instead, an attacker may be able to manipulate a JSON path supplied to an application. AshSqlite constructs paths used by SQLite’s json_extract function without properly escaping certain special characters.

Characters including periods, square brackets and the dollar sign can alter how SQLite interprets the requested JSON path.

This means an attacker could potentially turn what should be a request for a single JSON field into a request for a nested field elsewhere in the same JSON object.

For example, an application might allow users to request a particular field from a JSON object. If that input is passed directly to the vulnerable get_path/2 functionality, an attacker could potentially manipulate the requested path and access information that was supposed to remain hidden.

Sensitive information could be exposed

The security implications depend heavily on how an affected application has been designed.

An application that does not allow untrusted users to control get_path/2 input may have significantly less exposure.

However, applications providing public APIs, filtering systems, calculations or field-selection functionality could be vulnerable if external users can influence the JSON path.

Security researchers demonstrated a scenario in which a JSON object contained both a publicly accessible field and a nested secret value. By manipulating the requested path, the hidden value could potentially be returned by an endpoint that was only intended to expose permitted fields.

This could potentially result in the disclosure of API keys, internal configuration information or other sensitive values stored within JSON data.

Which versions are affected?

According to the CVE record, AshSqlite versions from 0.1.2-rc.0 up to, but not including, 0.2.18 are affected.

The vulnerability has been fixed in AshSqlite 0.2.18.

Developers using AshSqlite should therefore check their dependency versions and update affected installations as soon as practical.

Applications should also be reviewed to determine whether untrusted input can reach get_path/2 when working with JSON or map columns.

Developers urged to review applications

Simply upgrading the library may not be enough for organisations that have built APIs allowing users to select or query JSON fields dynamically.

Developers should review these interfaces and ensure that users cannot arbitrarily specify JSON paths.

Where possible, applications should restrict field selection to a predefined list of permitted fields rather than allowing arbitrary paths supplied by clients.

Logs should also be examined for unusual field-selection requests containing characters associated with JSON path manipulation.

Another reminder about input validation

CVE-2026-77846 highlights an often-overlooked area of application security.

Developers commonly focus on protecting applications against SQL injection, command injection and other well-known attacks. However, data-processing functions and query languages can introduce their own injection vulnerabilities even when SQL itself is correctly parameterised.

In this case, the SQL query is parameterised, but the attacker can manipulate the JSON path language being interpreted by SQLite.

For organisations using AshSqlite, upgrading to version 0.2.18 or later and reviewing any externally controlled get_path/2 functionality should be treated as a priority.

At the time of writing, there is no indication that CVE-2026-77846 is being actively exploited in the wild.