https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 21:46:47 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-361830 EUVD-2026-361830 https://cve.radiocsirt.org/vuln/euvd-2026-361830 https://cve.radiocsirt.org/vuln/fkie_cve-2026-77846 <p>Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields.</p> <p>AshSqlite.SqlImplementation builds the SQLite json_extract path with &#34;$.&#34; &lt;&gt; Enum.join(right, &#34;.&#34;), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example &#34;private.secret&#34; descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose.</p> <p>This issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.</p> <p>Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to traverse into nested JSON the application never exposed, disclosing private or sensitive? embedded fields.</p> <p>AshSqlite.SqlImplementation builds the SQLite json_extract path with &#34;$.&#34; &lt;&gt; Enum.join(right, &#34;.&#34;), so a single segment containing ., [, ], or $ re-interprets the JSON path (for example &#34;private.secret&#34; descends two levels instead of naming one key). The path is bound as a parameter, so this is confined to the JSON-path grammar rather than SQL. Any endpoint that lets user input reach a get_path segment (a common pick-a-field pattern) can read nested values it never meant to expose.</p> <p>This issue affects ash_sqlite: from 0.1.2-rc.0 before 0.2.18.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-77846