AshSqlite vulnerability CVE-2026-77846 exposes sensitive JSON fields

A new vulnerability, identified as CVE-2026-77846, has been disclosed in AshSqlite, the SQLite data layer used by the Ash Framework. The Erlang Ecosystem Foundation’s CNA issued the vulnerability entry on August 30, 2026.

The flaw is described as a “JSONPath injection” rather than a traditional SQL injection. It occurs because AshSqlite generates JSON paths using a “$. ”-style construction without escaping or quoting individual path segments. This allows attackers to use special characters like dots, brackets, or dollar signs to manipulate how SQLite interprets JSON paths.

By providing untrusted input to the get_path/2 functionality, an attacker can traverse nested JSON structures to access hidden or sensitive fields within JSON and map columns. The vulnerability is particularly relevant when applications allow user-controlled input to reach public calculations, filters, or APIs that select JSON fields.

Versions 0.1.2-rc.0 through those prior to 0.2.18 are affected. Version 0.2.18 has been released as a patched version to address the issue.