CVE-2026-108474

Summary

A SQL injection vulnerability in JetBrains Exposed allows attackers to execute arbitrary SQL commands through unescaped string arguments in SQL functions, potentially leading to full database compromise.

Exploitability

Exploitation is relatively straightforward for attackers with access to the application layer, requiring only properly crafted input that gets passed directly into SQL functions without proper escaping.

Blast radius

The impact could be severe across all applications using JetBrains Exposed versions prior to 1.5.1, potentially exposing sensitive user data, allowing unauthorized database modifications, and enabling further lateral movement within the application's data layer.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to JetBrains Exposed 1.5.1 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.