Loading vulnerability…
SQL injection in JetBrains Exposed SQL functions
CVE-2026-108474 is an SQL injection vulnerability in JetBrains Exposed, a database-access library for Kotlin applications, affecting versions before 1.5.1. Several SQL functions fail to escape string arguments adequately. When untrusted input reaches those arguments, an attacker can alter generated SQL queries, potentially enabling unauthorized access to or modification of database data. The specific affected functions are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker who can influence affected string arguments could alter SQL queries and potentially access or modify database data without authorization. The extent of the impact depends on how the application uses the vulnerable functions and the permissions of its database connection.
If you can’t patch tonight, do this now.
Until upgraded, prevent untrusted input from reaching string arguments of the affected SQL functions. A vendor-approved workaround and the specific affected functions are not identified.
Patch, then assume compromise.
Upgrade JetBrains Exposed to version 1.5.1 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.