CVE-2026-77846: CWE-943 Improper Neutralization of Special Elements in Data Query Logic in ash-project ash_sqlite

The vulnerability arises from ash_sqlite's AshSqlite.SqlImplementation constructing SQLite json_extract paths by concatenating "$." with user-controlled segments joined by ".". If a segment contains special JSON path characters such as '.', '[', ']', or '$', it can alter the intended JSON path traversal, allowing an attacker to descend into nested JSON fields that the application does not expose. This flaw is confined to JSON path grammar and does not affect SQL syntax directly. Any endpoint that accepts user input into a get_path segment can be exploited to read private or sensitive embedded JSON values. The issue affects ash_sqlite versions from 0.1.2-rc.0 before 0.2.18.

An attacker with the ability to control a get_path/2 segment can access nested JSON data fields that are meant to be private or sensitive, potentially disclosing information not intended for exposure. The impact is limited to information disclosure within JSON data structures and does not extend to broader SQL injection or system compromise. The CVSS 4.0 base score is 2.1, indicating low severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing user input directly in get_path segments used in JSON path queries or implement strict validation and sanitization of such input to prevent special JSON path characters from altering query logic.