CVE-2026-78691: CWE-943 Improper Neutralization of Special Elements in Data Query Logic in ash-project ash_sql

The vulnerability arises from improper escaping in ash_sql's search functions (contains/2, string_starts_with/2, string_ends_with/2) that use SQL LIKE patterns. The escape helpers prefix % and _ with a backslash but fail to escape existing backslashes in input, allowing an attacker to inject live wildcards by crafting inputs like \\%. This leads to unintended pattern matching behavior within the LIKE grammar, enabling attackers to widen matches, bypass negated contains guards, or cause query crashes with trailing backslashes. The issue is confined to LIKE pattern manipulation and does not affect full SQL query parameterization.

The impact is limited to manipulation of SQL LIKE pattern matching, potentially allowing attackers to broaden search results, bypass certain query filters, or cause query errors. There is no direct full SQL injection or privilege escalation. The CVSS score of 2.1 reflects low severity and limited attack vector (local access). No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor vendor communications for updates. Since the vulnerability is limited to LIKE pattern escaping, temporary mitigations could include sanitizing inputs to avoid backslash sequences or avoiding use of affected search functions until a fix is available.