EEF-CVE-2026-78691 CVE-2026-78691 GHSA-5jgp-7mhc-6qqh
Unescaped backslash allows LIKE wildcard injection in AshSql string search
- Severity
- 0.0 / 10
- Unknown · CVSS 4.0
- Exploit chance (EPSS)
- 0.20%
- Chance of exploitation in the next 30 days. Higher than 9.43% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-943 Improper Neutralization of Special Elements in Data Query Logic
- Fix
0.7.1- Upgrade ash_sql to this version or later
Description
Summary
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sql allows a user who supplies a search term to contains/2, string_starts_with/2, or string_ends_with/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled pattern match.
The escape helpers in AshSql.Expr prefix % and _ with a backslash but never escape a backslash already present in the input. Because backslash is the default LIKE escape character, the escaping defeats itself: the input \% becomes the pattern fragment \\%, where \\ is a literal backslash and the attacker's % remains a live wildcard. The search value stays parameterized, so this is confined to the LIKE pattern grammar rather than full SQL. An attacker can widen matches to probe values, slip past a negated contains(...) guard, or crash the query with a trailing lone backslash.
This issue affects ash_sql: from 0.1.1-rc.10 before 0.7.1.
Configurations
An application must pass untrusted input as the search term of contains/2, string_starts_with/2, or string_ends_with/2 (for example a user-controlled substring search).
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| ash_sql | >= 0.1.1-rc.10, < 0.7.1 |
0.7.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ash_sql Hex → 0.7.1
- mix
{:ash_sql, "~> 0.7.1"} # then: mix deps.update ash_sql
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-943: Improper Neutralization of Special Elements in Data Query Logic
The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-77454 exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql | Not rated yet | Also affects ash_sql |
| EEF-CVE-2026-81316 Same-named aggregates with differing filters are conflated in AshSql | Not rated yet | Also affects ash_sql |
| EEF-CVE-2026-81318 Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql | Not rated yet | Also affects ash_sql |
| EEF-CVE-2026-80227 SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql | Not rated yet | Also affects ash_sql |
| GHSA-v6q3-xqxm-6f5v Ghost: Invite Token Disclosure in Ghost Admin API | High | Same weakness, CWE-943 |
| GHSA-53vv-xm9f-mm82 Ghost: Password Hash Ordering Disclosure in Ghost Admin API | Low | Same weakness, CWE-943 |
| GHSA-6q6j-f24j-p477 Ghost: Authorization Bypass in Comments Feature | High | Same weakness, CWE-943 |
| GHSA-qrh6-cwg3-343x Ghost: Authorization Bypass in Comment Like Feature | High | Same weakness, CWE-943 |
Credits: Jonatan Männchen / EEF, Peter Ullrich, Zach Daniel / Ash Project
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor