Vulnerabilities in ash-project
91 resultsCVE-2026-78216MEDIUMAshLua eval read operations can read field-policy-protected fields via aggregatesEPSS 0.4%CVE-2026-82724HIGHBroken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomainEPSS 0.4%CVE-2026-80223HIGHCross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped readEPSS 0.4%CVE-2026-105283MEDIUMInternal error terms inspected into AshTypescript RPC error responsesEPSS 0.4%CVE-2025-48043HIGHBypass and runtime policies that can never pass may be incorrectly applied in filter authorizationEPSS 0.4%CVE-2026-82367LOWRe-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topicEPSS 0.4%CVE-2026-78038MEDIUMJob argument injection via :args overrides primary_key and tenant in AshObanEPSS 0.4%CVE-2026-80227LOWSQL string_trim removes only spaces, diverging from in-memory trimming in AshSqlEPSS 0.4%CVE-2026-81319MEDIUMUnsafe deserialization of decrypted terms enables node DoS in AshCloakEPSS 0.4%CVE-2026-69659MEDIUMMemory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.KeysetEPSS 0.4%CVE-2026-101028MEDIUMAsh.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sortsEPSS 0.3%CVE-2025-48042HIGHBefore action hooks may execute in certain scenarios despite a request being forbiddenEPSS 0.3%CVE-2026-94201HIGHFiltering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in AshEPSS 0.3%CVE-2026-77956HIGHEEx template evaluation of prompt content in AshAi enables remote code executionEPSS 0.3%CVE-2026-81315HIGHMCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto headerEPSS 0.3%CVE-2026-96581HIGHAn upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's recordsEPSS 0.3%CVE-2026-115635MEDIUMAshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is setEPSS 0.2%CVE-2026-115627MEDIUMAshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rowsEPSS 0.2%CVE-2026-114214MEDIUMLoading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination recordsEPSS 0.2%CVE-2026-55736MEDIUMPrivate action arguments can be set by user input in AshEPSS 0.2%