The escape helpers in AshSql.Expr prefix % and _ with a backslash but never escape a backslash already present in the input. Because backslash is the default LIKE escape character, the escaping defeats itself: the input \% becomes the pattern fragment \\%, where \\ is a literal backslash and the attacker's % remains a live wildcard. The search value stays parameterized, so this is confined to the LIKE pattern grammar rather than full SQL. An attacker can widen matches to probe values, slip past a negated contains(...) guard, or crash the query with a trailing lone backslash.
This issue affects ash_sql: from 0.1.1-rc.10 before 0.7.1.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ash-project | ash_sql | unaffected |
|
||||||
| ash-project | ash_sql | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 30 Aug 2026 12:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sql allows a user who supplies a search term to contains/2, string_starts_with/2, or string_ends_with/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled pattern match. The escape helpers in AshSql.Expr prefix % and _ with a backslash but never escape a backslash already present in the input. Because backslash is the default LIKE escape character, the escaping defeats itself: the input \% becomes the pattern fragment \\%, where \\ is a literal backslash and the attacker's % remains a live wildcard. The search value stays parameterized, so this is confined to the LIKE pattern grammar rather than full SQL. An attacker can widen matches to probe values, slip past a negated contains(...) guard, or crash the query with a trailing lone backslash. This issue affects ash_sql: from 0.1.1-rc.10 before 0.7.1. | |
| Title | Unescaped backslash allows LIKE wildcard injection in AshSql string search | |
| First Time appeared |
Ash-project
Ash-project ash Sql |
|
| Weaknesses | CWE-943 | |
| CPEs | cpe:2.3:a:ash-project:ash_sql:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Ash-project
Ash-project ash Sql |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: EEF
Published:
Updated: 2026-08-30T11:55:20.331Z
Reserved: 2026-08-30T05:45:01.818Z
Link: CVE-2026-78691
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-30T12:17:18.550
Modified: 2026-08-30T12:17:18.550
Link: CVE-2026-78691
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-30T13:30:05Z
-
CWE-943
Improper Neutralization of Special Elements in Data Query Logic