Ash Sqlite
Monthly
JSON path injection in AshSqlite (0.1.2-rc.0 through 0.2.17) allows any attacker who can supply user-controlled input to a get_path/2 query segment to read nested JSON sub-fields that the application never intended to expose. The vulnerable AshSqlite.SqlImplementation code naively concatenates user-supplied segments with periods into a SQLite json_extract path, so a segment containing a dot (e.g., 'private.secret') descends two JSON levels instead of matching a single literal key. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog; a vendor patch is available targeting version 0.2.18.
JSON path injection in AshSqlite (0.1.2-rc.0 through 0.2.17) allows any attacker who can supply user-controlled input to a get_path/2 query segment to read nested JSON sub-fields that the application never intended to expose. The vulnerable AshSqlite.SqlImplementation code naively concatenates user-supplied segments with periods into a SQLite json_extract path, so a segment containing a dot (e.g., 'private.secret') descends two JSON levels instead of matching a single literal key. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog; a vendor patch is available targeting version 0.2.18.