CVE-2026-76904

Summary

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

Severity

critical

CVSS

9.8

EPSS

4.0% (p90)

CWE

CWE-89

Also known as

GHSA-mqjf-5f49-2fjh

Published

2026-08-21

Updated

2026-08-21

Advisory details

Summary

An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:

• jsonArrayContains function
  Requires PostGIS 12 or greater with a String or JSON field

For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping.

Patches

• GeoTools 35.1
• GeoTools 33.5
• GeoTools 34.4

Mitigation

No mitigation is available:

• To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

Impact

This vulnerability can lead to execution of arbitrary SQL expressions in the database.

References

• https://osgeo-org.atlassian.net/browse/GEOT-7958
• https://osgeo-org.atlassian.net/browse/GEOT-7959
• https://github.com/geotools/geotools/pull/5829
• https://osgeo-org.atlassian.net/browse/GEOT-7589

References

• https://github.com/advisories/GHSA-mqjf-5f49-2fjh
• https://github.com/geotools/geotools/security/advisories/GHSA-mqjf-5f49-2fjh
• https://github.com/geotools/geotools/pull/5829
• https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176
• https://github.com/geotools/geotools/releases/tag/33.6
• https://github.com/geotools/geotools/releases/tag/34.5
• https://github.com/geotools/geotools/releases/tag/35.1
• https://osgeo-org.atlassian.net/browse/GEOT-7589

Related advisories

• CVE-2026-105845 — critical · npm/payload
• CVE-2026-69085 — critical · Go/github.com/siyuan-note/siyuan/kernel
• CVE-2026-79752 — critical · Packagist/cakephp/database
• CVE-2026-75513 — critical · NuGet/Marten
• CVE-2026-77635 — critical · Packagist/cakephp/cakephp
• CVE-2026-72811 — critical · Go/github.com/siyuan-note/siyuan/kernel
• CVE-2026-71867 — critical · npm/orval
• CVE-2026-71866 — critical · npm/orval

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity