CVE-2026-78691— Unescaped backslash allows LIKE wildcard injection in AshSql string search
Quick assessment
Affected
ash-project ash_sql
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述信息的中文翻译： ash-project 中的 ash_sql 存在“数据查询逻辑中特殊元素中和不当”漏洞，允许向 、 或 提供搜索词的用户注入有效的 SQL LIKE 通配符，从而将字面子串搜索转变为攻击者可控的模式匹配。 AshSql.Expr 中的转义辅助函数会使用反斜杠对 和 进行转义，但从未转义输入中已经存在的反斜杠。由于反斜杠是 LIKE 语句的默认转义字符，这种转义方式实际上抵消了自身的效果：输入中的 会变成模式片段 ，其中 表示一个字面意义上的反斜杠，而攻击者输入的 仍然保持为有效的
Possible ATT&CK Techniques 1 AI
T1059.002 · AppleScript
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78691
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unescaped backslash allows LIKE wildcard injection in AshSql string search
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sql allows a user who supplies a search term to contains/2, string_starts_with/2, or string_ends_with/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled pattern match.
The escape helpers in AshSql.Expr prefix % and _ with a backslash but never escape a backslash already present in the input. Because backslash is the default LIKE escape character, the escaping defeats itself: the input \% becomes the pattern fragment \\%, where \\ is a literal backslash and the attacker's % remains a live wildcard. The search value stays parameterized, so this is confined to the LIKE pattern grammar rather than full SQL. An attacker can widen matches to probe values, slip past a negated contains(...) guard, or crash the query with a trailing lone backslash.
This issue affects ash_sql: from 0.1.1-rc.10 before 0.7.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
数据查询逻辑中特殊元素的不当中和
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ash-project | ash_sql | 0.1.1-rc.10 ~ 0.7.1 |
cpe:2.3:a:ash-project:ash_sql:*:*:*:*:*:*:*:*
|
|
| ash-project | ash_sql | cfc7da474c5be2190fd62664a83a689377a8d512 ~ d95c55c64b1b42cc2fd30211a4913f3145156cd4 |
cpe:2.3:a:ash-project:ash_sql:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-78691
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78691
请登录查看更多情报信息。
Other References for CVE-2026-78691 (4)
-
CVE-2026-78691 related
-
EEF-CVE-2026-78691 - OSV related
Same Patch Batch · ash-project · 2026-08-30 · 11 CVEs total
| CVE-2026-75847 | 5.9 MEDIUM | Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail |
| CVE-2026-77970 | 5.9 MEDIUM | Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions |
| CVE-2026-78038 | 5.9 MEDIUM | Job argument injection via :args overrides primary_key and tenant in AshOban |
| CVE-2026-78228 | 5.9 MEDIUM | Unbounded handle_error recursion enables denial of service in AshOban triggers |
| CVE-2026-77454 | 5.9 MEDIUM | exists/2 predicate silently dropped on limited relationships with a parent() filter in Ash |
| CVE-2026-77831 | 2.1 LOW | Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking |
| CVE-2026-77846 | 2.1 LOW | JSON path injection via unescaped get_path segments in AshSqlite |
| CVE-2026-81318 | 2.1 LOW | Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql |
| CVE-2026-80227 | 2.1 LOW | SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql |
| CVE-2026-81316 | 2.1 LOW | Same-named aggregates with differing filters are conflated in AshSql |
IV. Related Vulnerabilities
Same product: ash_sql
-
CVE-2026-77454
exists/2 predicate silently dropped on limited relationships -
CVE-2026-81316
Same-named aggregates with differing filters are conflated i -
CVE-2026-81318
Distinct-query aggregate drops the tenant schema prefix, lea -
CVE-2026-80227
SQL string_trim removes only spaces, diverging from in-memor
Same vendor: ash-project
-
CVE-2026-77454
exists/2 predicate silently dropped on limited relationships -
CVE-2026-81316
Same-named aggregates with differing filters are conflated i -
CVE-2026-81318
Distinct-query aggregate drops the tenant schema prefix, lea -
CVE-2026-80227
SQL string_trim removes only spaces, diverging from in-memor -
CVE-2026-78228
Unbounded handle_error recursion enables denial of service i
Same weakness: CWE-943
-
CVE-2026-77846
JSON path injection via unescaped get_path segments in AshSq -
CVE-2026-81528
NoSQL injection via array replacement bypassing update shape -
CVE-2026-81527
NoSQL injection via unquoted constant GroupBy keys in LINQ p -
CVE-2026-81525
Cross-tenant database retargeting via dot/NUL injection in n -
CVE-2026-56094
Information Disclosure in extension "Apache Solr for TYPO3 -
V. Comments for CVE-2026-78691
No comments yet