AshSqlite CVE-2026-77846

Exploitation requires that the application exposes at least one endpoint or query parameter where user-supplied string input is placed directly into a get_path/2 segment list without prior sanitization - the description characterizes this as 'a common pick-a-field pattern.' The attacker must additionally know (or be willing to enumerate) the nested key names present in the target JSON column. Exploitation is bounded to JSON sub-field disclosure within the single column already accessible via get_path; cross-table reads, data modification, and denial of service are not achievable. The CVSS PR:N indicates no authentication is required by the library itself, but actual exploitability depends entirely on whether the consuming application exposes the vulnerable endpoint without authentication; endpoints requiring authentication substantially reduce realistic risk. No non-default OS, platform, or database configuration is required beyond running ash_sqlite 0.1.2-rc.0 through 0.2.17 with a SQLite backend.

The overall risk is low but non-trivial for applications that expose user-controlled field selection over JSON columns. The CVSS 4.0 score of 2.1 reflects a read-only, partial confidentiality impact (VC:L) with no integrity or availability loss; AT:P acknowledges that a specific enabling condition must be present in the application. The AV:L designation in the provided CVSS 4.0 vector warrants scrutiny - the description explicitly frames the vulnerability as reachable through application endpoints that accept user input, which in most real deployments means network-accessible APIs; security teams should verify actual network exposure of their get_path endpoints rather than anchoring on AV:L. EPSS data was not provided, and the CVE is absent from the CISA KEV catalog, meaning no confirmed active exploitation exists at time of analysis. Impact is strictly bounded to JSON sub-field disclosure within the single column already targeted by the get_path call - no cross-table reads, data modification, or availability impact is possible. The patch is low-risk and localized.

An attacker using an API endpoint that accepts a user-supplied field name parameter mapped to a get_path/2 call submits the value 'public_info.secret_token' as a single segment. AshSqlite assembles the path '$.public_info.secret_token', which SQLite interprets as a two-level descent, returning the value at json_column['public_info']['secret_token'] - a nested field the application intended to keep private. No public proof-of-concept code is known, but the attack is trivially constructable by anyone who can enumerate the target column's JSON schema.