- The vulnerability stems from unsafe construction of JSON paths using unescaped input in the get_path/2 function.
- Attackers can traverse into restricted JSON structures to leak sensitive or private embedded fields.
- Security is restored by upgrading to AshSqlite version 0.2.18 or later.
Every now and then, a bug pops up that reminds us why handling user input is such a minefield. The recently uncovered CVE-2026-77846 is a prime example, targeting the way AshSqlite handles data queries. While it might sound like a typical SQL injection at first glance, it’s actually a different beast entirely, focusing on the JSON path grammar rather than the database engine’s core commands.
This specific flaw hits the Ash Framework’s SQLite data layer, specifically affecting versions from 0.1.2-rc.0 up to 0.2.17. It basically opens a door for clever attackers to peek into parts of the database that were supposed to stay hidden, making it a serious confidentiality risk for apps that let users pick which fields they want to see via an API.
The Mechanics of the Injection
At the heart of the problem is the get_path/2 functionality within AshSqlite.SqlImplementation. In the vulnerable versions, the system was building JSON paths using a simple string concatenation: “$.” <> Enum.join(right, “.”). Because the individual segments weren’t quoted or escaped, the system just trusted that the input was a simple key name.
Here is where things get messy: characters like dots, brackets, and dollar signs have special meanings in SQLite’s json_extract. If a user provides a value like “private.secret”, the system doesn’t see it as a single key named “private.secret”. Instead, it interprets the dot as a path separator, causing the query to dive two levels deep into the JSON object. This allows an attacker to bypass intended restrictions and pull out data from nested objects that the developers never meant to expose to the public.
Impact and Real-World Risk
The danger is most acute when an application allows untrusted input to reach the path segment—think of a public filter or a dynamic calculation where a user can specify a field. In a typical scenario, a user might be allowed to request a field called “title”. However, by manipulating the request to traverse into nested JSON, they could potentially access sensitive API keys or internal configuration data stored in the same column.
A proof-of-concept demonstrated this perfectly using AshSqlite 0.2.17. By creating a record with a public “title” and a nested “private” object containing a secret, researchers showed that a simple change in the request parameter could leak the secret key. It’s important to note that this is not a SQL injection because the path is passed as a bound parameter; the attacker is simply playing with the JSONPath grammar to trick the database into returning the wrong data.
How to Lock Down Your System
The good news is that there is a clear way out. The Ash Project released a fix in version 0.2.18. This update replaces the naive string joining with a robust encoding mechanism. The new version properly escapes backslashes and quotes, and it handles numeric array indexes as separate entities, ensuring that a dot in a key name is treated as a literal character rather than a path instruction.
For those managing these systems, the priority is to update to 0.2.18 or newer immediately. While you’re at it, it’s a smart move to audit any API endpoints that allow dynamic field selection. If you can’t upgrade right away, you should restrict dynamic calls to a predefined list of safe names or implement a strict filter that rejects any input containing periods, brackets, or dollar signs. Checking your logs for unusual characters in field-selection requests can also help you spot if someone has already been poking around your system.
Dealing with CVE-2026-77846 highlights the importance of strict input validation, especially when dealing with complex data formats like JSON. By moving to the patched version of ash_sqlite and auditing how external input interacts with database paths, developers can effectively shut down this traversal vector and keep their sensitive embedded fields private.
