Malformed input is useful before any successful traversal. An unbalanced bracket or a bare $ in a field-selection parameter makes SQLite throw JSON path errors, and those errors describe the structure the caller was never shown [10]. An attacker can enumerate with the same parameter used to extract [10].
The proof of concept ran AshSqlite 0.2.17 [8]. The advisory range starts at 0.1.2-rc.0 and stops just short of 0.2.18 [3], which puts the demonstration on the last affected release rather than an old one [15]. The patch is small: 0.2.18 drops the join and encodes each key, escaping backslashes and quotes and handling numeric array indexes separately [11].
Reachability decides exposure here. The traversal happens only when untrusted input reaches get_path/2, through a public calculation, a filter, or an API that lets callers pick which JSON field they want [16]. The Cyber Express notes that internal applications without untrusted callers face lower exposure, while public search, filtering and field-selection APIs need validation and access controls [14].
If the upgrade has to wait, the interim control is an allowlist. Restrict dynamic get_path/2 calls to predefined names, reject periods and brackets in the input, and stop handing out arbitrary JSON paths [12]. After upgrading, the work is unglamorous: dependency locks and deployment images checked for older ash_sqlite, logs read for unusual dots, brackets and JSONPath symbols in field-selection requests [13]. Those log hits do not prove exploitation, they only tell you where to look [13].
The GitHub advisory files this as "JSONPath injection in AshSqlite.SqlImplementation get_path", and says an attacker controlling one path segment can traverse nested JSON and disclose private fields [6]. In your own code the thing worth grepping for is the concatenation itself: a caller-named segment joined into a string that something downstream will parse as a grammar [4]. SQLite's JSON path is one such grammar. Parameter binding does not cover it, because the binding protects the SQL layer and the parsing happens after [7].
