https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T10:07:58.210034+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/ghsa-mqjf-5f49-2fjh GHSA-mqjf-5f49-2fjh — GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers 2026-10-07T10:07:58.230225+00:00

Affected: Maven: org.geotools.jdbc:gt-jdbc-postgis

### Summary

An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:

* `jsonArrayContains` function Requires PostGIS 12 or greater with a String or JSON field

For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping.

### Patches

* GeoTools 35.1 * GeoTools 33.5 * GeoTools 34.4

### Mitigation

No mitigation is available:

* To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

### Impact

This vulnerability can lead to execution of arbitrary SQL expressions in the database.

### References

* https://osgeo-org.atlassian.net/browse/GEOT-7958 * https://osgeo-org.atlassian.net/browse/GEOT-7959 * https://github.com/geotools/geotools/pull/5829 * https://osgeo-org.atlassian.net/browse/GEOT-7589