CVE-2026-78691
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sql allows a user who supplies a search term to contains/2, string_starts_with/2, or string_ends_with/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled pattern match. The escape helpers in AshSql.Expr prefix % and _ with a backslash but never escape a backslash already present in the input. Because backslash is the default LIKE escape character, the escaping defeats itself: the input \% becomes the pattern fragment \\%, where \\ is a literal backslash and the attacker's % remains a live wildcard. The search value stays parameterized, so this is confined to the LIKE pattern grammar rather than full SQL. An attacker can widen matches to probe values, slip past a negated contains(...) guard, or crash the query with a trailing lone backslash. This issue affects ash_sql: from 0.1.1-rc.10 before 0.7.1.
Scoring
- Severity
- LOW
- CVSS base score
- 2.1
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.14%
- CWE
- CWE-943
- Published
- 2026-08-30
- Last modified
- 2026-08-31
Affected products
- ash-project ash_sql
- ash-project ash_sql
Weakness type
Related vulnerabilities
- CVE-2026-88036 — GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C Driver
- CVE-2026-88034 — GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB C++ Driver
- CVE-2026-88033 — GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Java Driver
- CVE-2026-88031 — GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver
- CVE-2026-88030 — GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Ruby Driver
- CVE-2026-88029 — GridFS data disclosure and deletion via query-operator injection in file IDs in the MongoDB Python Driver
- CVE-2026-88028 — Unauthorized document disclosure via query-operator injection in polymorphic relation identifiers in MongoDB integration for Laravel
- CVE-2026-88027 — Mass deletion and overwrite of embedded documents via query-operator injection in embedded record keys in MongoDB integration for Laravel