GHSA-mqjf-5f49-2fjh

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-76904

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.geotools.jdbc:gt-jdbc-postgis	>= 35.0, < 35.1	35.1
Maven	org.geotools.jdbc:gt-jdbc-postgis	>= 34.0, < 34.5	34.5
Maven	org.geotools.jdbc:gt-jdbc-postgis	>= 30.5, < 33.6	33.6

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: * `jsonArrayContains` function Requires PostGIS 12 or greater with a String or JSON field For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping. ### Patches * GeoTools 35.1 * GeoTools 33.5 * GeoTools 34.4 ### Mitigation No mitigation is available: * To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights. ### Impact This vulnerability can lead to execution of arbitrary SQL expressions in the database. ### References * https://osgeo-org.atlassian.net/browse/GEOT-7958 * https://osgeo-org.atlassian.net/browse/GEOT-7959 * https://github.com/geotools/geotools/pull/5829 * https://osgeo-org.atlassian.net/browse/GEOT-7589

References

External links from the advisory. They lead to third-party sites.