Erlang Ecosystem Foundation: AshSqlite Vulnerability (CVE-2026-77846) Exposes Hidden JSON Fields

Critical AshSqlite Vulnerability (CVE-2026-77846) Exposes Hidden JSON Data in Database Queries

On August 30, 2026, the Erlang Ecosystem Foundation’s CNA disclosed CVE-2026-77846, a JSONPath injection vulnerability in AshSqlite, a SQLite integration layer for the Ash Framework. The flaw allows attackers to traverse nested JSON structures and access sensitive or hidden fields in database records by manipulating untrusted input in field-selection requests.

Key Details

• Affected Versions: AshSqlite 0.1.2-rc.0 through 0.2.17 (patched in 0.2.18).
• Root Cause: Unsafe construction of JSON paths, where attacker-controlled input (e.g., dots, brackets, or JSONPath symbols) could alter path interpretation, exposing nested data unintended for public access.
• Exploitation Vector: Attackers exploit the flaw via public APIs, search filters, or field-selection endpoints that accept untrusted input. A proof-of-concept (PoC) demonstrated how a single malicious path segment could leak nested values (e.g., {"private": {"secret": "api-key"}}).
• Impact: Systems processing untrusted input (e.g., public-facing applications) are at higher risk, while internal applications with trusted callers face lower exposure. The vulnerability does not involve SQL injection but abuses SQLite’s JSON path handling.

Mitigation & Fixes

• Patch: Upgrade to AshSqlite 0.2.18 or later, which replaces unsafe path joining with secure encoding, escaping backslashes/quotes, and separate handling of numeric array indexes.
• Temporary Workarounds: Restrict dynamic field-selection input, audit logs for unusual JSONPath characters (e.g., dots, brackets), and review dependency locks for older versions.
• Detection: Monitor for malformed input (e.g., unbalanced brackets) or SQLite JSON path errors, which may indicate exploitation attempts.

The vulnerability underscores the risks of improper input validation in JSON path processing, particularly in applications handling sensitive data. Organizations using AshSqlite should prioritize upgrades and audits of affected systems.

Source: https://thecyberexpress.com/cve-2026-77846-ashsqlite-vulnerability/

Erlang Ecosystem Foundation TPRM report: https://www.rankiteo.com/company/erlef

"id": "erl1788171832",
"linkid": "erlef",
"type": "Vulnerability",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'name': 'Organizations using AshSqlite',
                        'type': 'Software Users'}],
 'attack_vector': 'Public APIs, search filters, or field-selection endpoints '
                  'accepting untrusted input',
 'data_breach': {'sensitivity_of_data': 'High (sensitive or hidden fields)',
                 'type_of_data_compromised': 'Nested JSON data (e.g., private '
                                             'fields, secrets, API keys)'},
 'date_publicly_disclosed': '2026-08-30',
 'description': 'On August 30, 2026, the Erlang Ecosystem Foundation’s CNA '
                'disclosed CVE-2026-77846, a JSONPath injection vulnerability '
                'in AshSqlite, a SQLite integration layer for the Ash '
                'Framework. The flaw allows attackers to traverse nested JSON '
                'structures and access sensitive or hidden fields in database '
                'records by manipulating untrusted input in field-selection '
                'requests.',
 'impact': {'data_compromised': 'Sensitive or hidden fields in database '
                                'records (e.g., nested JSON data)',
            'operational_impact': 'Potential exposure of unintended data in '
                                  'public-facing applications',
            'systems_affected': 'Systems using AshSqlite versions 0.1.2-rc.0 '
                                'through 0.2.17'},
 'lessons_learned': 'Risks of improper input validation in JSON path '
                    'processing, particularly in applications handling '
                    'sensitive data',
 'post_incident_analysis': {'corrective_actions': 'Secure encoding, escaping '
                                                  'backslashes/quotes, and '
                                                  'separate handling of '
                                                  'numeric array indexes in '
                                                  'JSON paths',
                            'root_causes': 'Unsafe construction of JSON paths '
                                           'in AshSqlite, allowing '
                                           'attacker-controlled input to alter '
                                           'path interpretation'},
 'recommendations': 'Prioritize upgrades to AshSqlite 0.2.18 or later; audit '
                    'affected systems; restrict dynamic field-selection input; '
                    'monitor for exploitation attempts',
 'references': [{'source': 'Erlang Ecosystem Foundation’s CNA'}],
 'response': {'containment_measures': 'Upgrade to AshSqlite 0.2.18 or later; '
                                      'restrict dynamic field-selection input; '
                                      'audit logs for unusual JSONPath '
                                      'characters',
              'enhanced_monitoring': 'Monitor for malformed input (e.g., '
                                     'unbalanced brackets) or SQLite JSON path '
                                     'errors',
              'remediation_measures': 'Patch to AshSqlite 0.2.18 or later; '
                                      'secure encoding and escaping of JSON '
                                      'paths'},
 'title': 'Critical AshSqlite Vulnerability (CVE-2026-77846) Exposes Hidden '
          'JSON Data in Database Queries',
 'type': 'JSONPath Injection Vulnerability',
 'vulnerability_exploited': 'CVE-2026-77846'}