In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions

Critical CVSS 9.8

CVECVE-2026-108474

First seen2026-10-10 00:31 UTC

Disclosed2026-10-10 00:17 UTC

Last updated2026-10-14 16:31 UTC

Channel statusauto

Summary

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).