Vulnerabilities in ash-project
91 resultsCVE-2026-81633MEDIUMUnhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segmentEPSS 0.5%CVE-2026-82586HIGHAshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributesEPSS 0.5%CVE-2026-78693MEDIUMIncomplete redaction re-attaches the original error path in AshGraphql, leaking internal field namesEPSS 0.5%CVE-2026-75757HIGHAshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomainEPSS 0.5%CVE-2024-49756MEDIUMAshPostgres empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability.EPSS 0.5%CVE-2026-82731LOWUnescaped path parameters in AshTypescript generated TypeScript client allow request redirectionEPSS 0.5%CVE-2026-82730HIGHAuthorization-redacted field values disclosed through AshTypescript result normalizationEPSS 0.5%CVE-2026-77850HIGHStored XSS in AshAdmin relationship typeahead via unescaped label_field contentEPSS 0.5%CVE-2026-82580MEDIUMAshAi echoes raw tool exception messages into the conversation, disclosing internal detailsEPSS 0.5%CVE-2026-75760HIGHAshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing errorEPSS 0.5%CVE-2026-82579MEDIUMAshAi tool loop never terminates when all tool calls are filtered out, enabling denial of serviceEPSS 0.5%CVE-2026-82722HIGHAshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)EPSS 0.5%CVE-2026-82681LOWQuery-parameter injection in AshAdmin row-action links via unencoded string primary keysEPSS 0.5%CVE-2026-82727LOWAshPhoenix Form.Auto leaks submitted params in an unknown _union_type error messageEPSS 0.5%CVE-2026-81853LOWAshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracleEPSS 0.4%CVE-2026-82725LOWAshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related dataEPSS 0.4%CVE-2026-34593HIGHAsh Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crashEPSS 0.4%CVE-2026-80223HIGHCross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped readEPSS 0.4%CVE-2026-82724HIGHBroken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomainEPSS 0.4%CVE-2026-78230MEDIUMAshAi aggregate tool can read field-policy-protected fieldsEPSS 0.4%