GHSA-MQJF-5F49-2FJH

Vulnerability from github – Published: 2026-08-21 20:25 – Updated: 2026-08-21 20:26
VLAI
Summary
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
Details

Summary

An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:

  • jsonArrayContains function
    Requires PostGIS 12 or greater with a String or JSON field

For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping.

Patches

  • GeoTools 35.1
  • GeoTools 33.5
  • GeoTools 34.4

Mitigation

No mitigation is available:

  • To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

Impact

This vulnerability can lead to execution of arbitrary SQL expressions in the database.

References

  • https://osgeo-org.atlassian.net/browse/GEOT-7958
  • https://osgeo-org.atlassian.net/browse/GEOT-7959
  • https://github.com/geotools/geotools/pull/5829
  • https://osgeo-org.atlassian.net/browse/GEOT-7589
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools.jdbc:gt-jdbc-postgis"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "35.0"
            },
            {
              "fixed": "35.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "35.0"
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools.jdbc:gt-jdbc-postgis"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "34.0"
            },
            {
              "fixed": "34.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools.jdbc:gt-jdbc-postgis"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "30.5"
            },
            {
              "fixed": "33.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-76904"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-21T20:25:41Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nAn SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:\n\n* `jsonArrayContains` function  \n    Requires PostGIS 12 or greater with a String or JSON field\n\nFor PostGIS 12 and greater `jsonArrayContains(\u003ccolumn\u003e, \u003cpointer\u003e, \u003cvalue\u003e)` function writes `\u003cvalue\u003e` into generated SQL without escaping.\n\n### Patches\n\n* GeoTools 35.1\n* GeoTools 33.5\n* GeoTools 34.4\n\n### Mitigation\n\nNo mitigation is available:\n\n* To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.\n\n### Impact\n\nThis vulnerability can lead to execution of arbitrary SQL expressions in the database.\n\n### References\n\n* https://osgeo-org.atlassian.net/browse/GEOT-7958\n* https://osgeo-org.atlassian.net/browse/GEOT-7959\n* https://github.com/geotools/geotools/pull/5829\n* https://osgeo-org.atlassian.net/browse/GEOT-7589",
  "id": "GHSA-mqjf-5f49-2fjh",
  "modified": "2026-08-21T20:26:29Z",
  "published": "2026-08-21T20:25:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/geotools/geotools/security/advisories/GHSA-mqjf-5f49-2fjh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geotools/geotools/pull/5829"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/geotools/geotools"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geotools/geotools/releases/tag/33.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geotools/geotools/releases/tag/34.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geotools/geotools/releases/tag/35.1"
    },
    {
      "type": "WEB",
      "url": "https://osgeo-org.atlassian.net/browse/GEOT-7589"
    },
    {
      "type": "WEB",
      "url": "https://osgeo-org.atlassian.net/browse/GEOT-7958"
    },
    {
      "type": "WEB",
      "url": "https://osgeo-org.atlassian.net/browse/GEOT-7959"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.