JetBrains Exposed 1.5.1 Fixes Critical SQL Injection Vulnerability CVE-2026-108474
JetBrains released version 1.5.1 to address a critical SQL injection flaw in its Exposed library, which allowed attackers to manipulate database queries via unescaped strings.
Key points
- CVE-2026-108474 is rated Critical with a CVSS score of 9.8.
- The vulnerability affects JetBrains Exposed versions prior to 1.5.1.
- Attackers could exploit unescaped string arguments in SQL functions to perform SQL injection.
JetBrains has released version 1.5.1 of its Exposed library to patch a critical security vulnerability that allowed for SQL injection attacks. The update addresses CVE-2026-108474, a flaw present in all versions of the library prior to 1.5.1.
At a glance
- CVE
- CVE-2026-108474
- Product
- JetBrains Exposed
- CVSS
- 9.8 Critical
- Weakness
- SQL injection
- Exploited
- No known exploitation
The vulnerability, classified as Critical with a CVSS score of 9.8, stems from improper handling of string arguments within several SQL functions in the Exposed framework. According to the National Vulnerability Database (NVD), the issue is categorized under CWE-89, which relates to SQL Injection. The flaw permitted attackers to inject malicious SQL code by passing unescaped string arguments, potentially allowing them to execute arbitrary commands against the underlying database.
Context and Background
Exposed is a lightweight SQL library written in Kotlin, designed to simplify database interactions for developers building applications on the JetBrains ecosystem. By providing a higher-level abstraction over raw SQL, it aims to reduce boilerplate code while maintaining performance. However, this abstraction can introduce security risks if the library fails to properly sanitize or escape user-supplied input before it reaches the database engine.
The specific weakness identified in CVE-2026-108474 involves the failure to escape string arguments in various SQL functions. When an application using an affected version of Exposed passes user-controlled data into these functions without proper validation, an attacker can manipulate the query structure. This type of vulnerability is among the most severe in web application security, as it can lead to unauthorized data access, data modification, or even complete system compromise, depending on the privileges of the database account used by the application.
Who Is Affected
Developers and organizations using JetBrains Exposed versions earlier than 1.5.1 are directly affected by this vulnerability. Any application relying on these older versions of the library to interact with SQL databases is potentially exposed to injection attacks. The risk is highest for applications that process user input and pass it directly into SQL functions provided by the library without additional application-level sanitization.
Security teams should audit their dependency trees to identify any projects utilizing Exposed versions below 1.5.1. Given the high severity rating, immediate attention is required to mitigate the risk of exploitation, especially for applications exposed to external networks or handling sensitive data.
What should you do?
The primary remediation step is to update the JetBrains Exposed library to version 1.5.1 or later. This update includes the necessary fixes to properly escape string arguments and prevent SQL injection. Organizations should verify that all dependent modules and services are compatible with the updated library version before deploying the fix to production environments.
What to do and how to stay safe: JetBrains
- Update JetBrains Exposed to version 1.5.1 or newer to apply the vendor-provided fix.
- Audit existing codebases for direct usage of SQL functions that accept string arguments to ensure no custom bypasses exist.
- Review database logs for unusual query patterns or unauthorized access attempts that may indicate prior exploitation.
- Implement strict input validation and parameterized queries in application logic as a defense-in-depth measure, even when using updated libraries.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-108474?
The CVSS score for CVE-2026-108474 is 9.8, which is rated as Critical.
Which versions of JetBrains Exposed are vulnerable?
All versions of JetBrains Exposed prior to 1.5.1 are affected by this vulnerability.
What type of weakness is CVE-2026-108474?
It is a SQL Injection vulnerability (CWE-89) caused by unescaped string arguments in SQL functions.
