Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields. AshSqlite.SqlImplementation builds the SQLite json_extract path with "$." <> Enum.join(right, "."), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example "private.secret" descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose. This issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-30 | 1 | Disclosure1 |
| 2026-09-02 | 1 | General1 |
Critical AshSqlite Vulnerability Could Expose Hidden JSON Data (CVE-2026-77846) https://www.systemtek.co.uk/2026/08/critical-ashsqlite-vulnerability-could-expose-hidden-json-data-cve-2026-77846/ via @SystemTek_UK
Post summary
The tweet announces a critical CVE-2026-77846 that could expose hidden JSON data via AshSqlite, but provides no PoC, exploit, patch, or detailed technical information.
CVE-2026-77846: Ευπάθεια JSON path στο AshSqlite εκθέτει κρυφά πεδία https://secn.ws/tkVWvC
Post summary
The post announces a new JSON path vulnerability (CVE‑2026‑77846) in AshSqlite that can expose hidden fields, with no further details on exploitation, patches, or active attacks.