{"id":"CVE-2026-108474","published":"2026-10-10T00:17:03.673","lastModified":"2026-10-14T16:08:15.347","description":"In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability in JetBrains Exposed allows attackers to execute arbitrary SQL commands through unescaped string arguments in SQL functions, potentially leading to full database compromise.","exploitability":"Exploitation is relatively straightforward for attackers with access to the application layer, requiring only properly crafted input that gets passed directly into SQL functions without proper escaping.","blast_radius":"The impact could be severe across all applications using JetBrains Exposed versions prior to 1.5.1, potentially exposing sensitive user data, allowing unauthorized database modifications, and enabling further lateral movement within the application's data layer.","remediation":"Upgrade to JetBrains Exposed 1.5.1 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","database","java","orm"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:43:53.789Z"}}