CVE-2026-78691 Unescaped backslash allows LIKE wildcard injection in AshSql string search
Attackers can inject SQL LIKE wildcards in AshSql string searches to bypass filters, probe data, or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-78691?
CVE-2026-78691 is a low-severity SQL injection vulnerability in ash-project ash_sql, published on 30 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sql allows a user who supplies a search term to contains/2, string_starts_with/2, or string_ends_with/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled pattern match.
The escape helpers in AshSql.Expr prefix % and _ with a backslash but never escape a backslash already present in the input. Because backslash is the default LIKE escape character, the escaping defeats itself: the input \% becomes the pattern fragment \\%, where \\ is a literal backslash and the attacker's % remains a live wildcard. The search value stays parameterized, so this is confined to the LIKE pattern grammar rather than full SQL. An attacker can widen matches to probe values, slip past a negated contains(...) guard, or crash the query with a trailing lone backslash.
This issue affects ash_sql: from 0.1.1-rc.10 before 0.7.1.
Weakness: CWE-943
Which versions are affected by CVE-2026-78691?
1 open source package ship an affected version, including ash_sql.
| Package | Affected | Fixed in |
|---|---|---|
ash_sql Hex | From 0.1.1-rc.10 | 0.7.1 |
How do I fix CVE-2026-78691?
Upgrade ash_sql to 0.7.1 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-78691 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-78691 exists.
Sources
Also known as EEF-CVE-2026-78691, GHSA-5jgp-7mhc-6qqh.