Vulnerabilidades em ash-project
91 resultadosAnálise Vexday
Ash Project apresenta um perfil de risco baixo com apenas 7 CVEs catalogadas, nenhuma atualmente sob exploração ativa. A vulnerabilidade dominante é CWE-863 (Uso Impróprio de Autorização), sem críticas de severidade máxima registradas. O risco é moderado dado 1 publicação nos últimos 90 dias, indicando manutenção ativa do projeto.
CVE-2026-78691LOWUnescaped backslash allows LIKE wildcard injection in AshSql string searchEPSS 0.2%CVE-2026-93477MEDIUMPrivate action arguments can be set by user input on the bulk destroy and bulk update paths in AshEPSS 0.2%CVE-2026-77846LOWJSON path injection via unescaped get_path segments in AshSqliteEPSS 0.2%CVE-2026-70395LOWPredicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in AshEPSS 0.2%CVE-2026-82744LOWAsh.Reactor change step fails open, skipping a change when its where guard raisesEPSS 0.2%CVE-2026-82741LOWAsh.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusionEPSS 0.2%CVE-2026-81638LOWNon-canonical ULID spellings are accepted and alias to the same record in ash_double_entryEPSS 0.2%CVE-2026-82734LOWNon-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.DecimalEPSS 0.2%CVE-2026-82738MEDIUMAsh.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of serviceEPSS 0.2%CVE-2026-82736LOWAsh.Type.CiString validates length and match constraints before case folding, allowing constraint bypassEPSS 0.2%CVE-2026-82737MEDIUMAsh.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing readsEPSS 0.2%CVE-2026-82739LOWAsh.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch errorEPSS 0.2%CVE-2026-82735MEDIUMMatch regex runs on over-length input in Ash.Type.String, enabling regex denial of serviceEPSS 0.2%CVE-2026-82742MEDIUMAsh.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memoryEPSS 0.2%CVE-2026-78228MEDIUMUnbounded handle_error recursion enables denial of service in AshOban triggersEPSS 0.2%CVE-2026-82743LOWAsh.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async readsEPSS 0.2%CVE-2026-77831LOWAlgorithmic-complexity denial of service in AshPaperTrail full-diff list trackingEPSS 0.2%CVE-2026-82752MEDIUMAsh string length constraints count graphemes, so a combining-mark string of any size passes max_lengthEPSS 0.2%CVE-2026-82740LOWAsh.Type ignores outer array constraints on nested {:array, {:array, type}} inputsEPSS 0.2%CVE-2026-77454MEDIUMexists/2 predicate silently dropped on limited relationships with a parent() filter in AshSqlEPSS 0.2%