JetBrains Exposed: SQL injection via unescaped string arguments in SQL functions
Summary
JetBrains Exposed, a Kotlin library for type-safe database access, contains an SQL injection flaw in versions before 1.5.1. Unescaped string arguments of several SQL functions, such as locate(), concat(), groupConcat() and match(), can be manipulated. An attacker who can get untrusted input into these functions could read, modify or delete database data. The CVSS vector requires no authentication, but exposure depends on each application that embeds Exposed.
Affected
- JetBrains Exposed before 1.5.1 (0 to < 1.5.1)
Fixed in
- Exposed 1.5.1 (fix attributed to EXPOSED-1093 in the changelog quoted in dependency pull requests; verify against the JetBrains advisory)
Workaround
Unknown. No documented workaround found. Interim measures (own analysis, not vendor guidance):
- Stop passing raw or user-supplied input into the affected functions until the upgrade is done.
- Run the database account with least privilege to limit impact.
Exploitation
- Not marked as known exploited in the sources reviewed (not verified against the CISA KEV catalogue).
- No public proof of concept found.
- VulDB's "0-Day" label describes disclosure status, not confirmed exploitation.
Our recommendation
- Identify applications that embed Exposed (check Gradle/Maven files and SBOMs).
- Upgrade to 1.5.1 and retest queries using the affected functions. Values pre-escaped on the client side may now be stored with doubled quotes.
- Ask software vendors whether their products use Exposed and whether they have shipped the fix.
- Check internet-facing and partner-facing applications first and monitor for exploitation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- NVD: CVE-2026-108474 nvd.nist.gov
- JetBrains: Fixed security issues www.jetbrains.com
- GitHub pull request 95 (changelog excerpt, EXPOSED-1093) github.com
- GitHub pull request 662 (behaviour change on escaping) github.com
- VulDB: CVE-2026-108474 vuldb.com
- VulDB: entry 416028 vuldb.com
- Canadian Cyber Centre mirror: JetBrains advisory AV26-1032 malware.news
- HOL Guard: CVE-2026-108474 (CISA ADP Vulnrichment, aggregator) hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:03.
Original description (NVD)
In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.