A critical SQL injection vulnerability in the geotools library enables unauthorized database access and manipulation, requiring an immediate update to patched versions.

This is a SQL injection vulnerability (CWE-89) stemming from the failure to properly escape input in the jsonArrayContains function when using PostGIS DataStore. An unauthenticated remote attacker can inject arbitrary SQL commands into the database backend, which may lead to unauthorized data retrieval or modification.

Successful exploitation allows an attacker to bypass standard application queries and interact directly with the underlying database. This threatens the confidentiality, integrity, and availability of sensitive geospatial data. Given the CVSS score of 9.8, this vulnerability presents a high risk of data breach and potential lateral movement within the database environment.

Immediate Action: Update to GeoTools versions 33.6, 34.5, or 35.1 to implement the necessary input sanitization.

Proactive Monitoring: Monitor database query logs for unusual or highly complex SQL commands, particularly those involving JSON functions or unexpected syntax.

Compensating Controls: Configure the PostGIS connection pool with the principle of least privilege, restricting the database user's permissions to the absolute minimum required for operation.

Public Exploit Available: Unknown

Organizations utilizing affected versions of the GeoTools library must prioritize the update to the latest patched releases. Given the potential for total database compromise, applying these patches is essential to securing the application infrastructure.