Declared argument constraints not enforced on AshTypescript typed controller routes

Summary

Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ash_typescript/typed_controller/request_handler.ex calls Ash.Type.cast_input/3 and treats an {:ok, cast} result as fully validated. In Ash these are separate steps: cast_input/3 only coerces the term, while every constraint declared on the argument is applied by Ash.Type.apply_constraints/3, which this path never calls. Constraints such as one_of, max_length, min and max, and match are therefore inert, so a value outside a declared allowlist is accepted and passed to the route handler. Codegen renders the same constraints into the generated TypeScript types, so an allowlist appears enforced to a TypeScript caller while any other HTTP client ignores it. Empty-string to nil normalization also lives in apply_constraints, so the allow_nil?: false check accepts "" for a required argument. Where a constraint gates a role, a status, or a sort direction, this becomes a privilege or state-machine bypass. This issue affects ash_typescript: from 0.15.0 before 0.18.0.

Timeline

1. Sep 1, 2026, 2:09 AM UTCCVE published
2. Sep 1, 2026, 2:54 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: no · Technical impact: partial

3. Sep 1, 2026, 2:55 PM UTCRecord last updated

Affected versions

• ash_typescript

  From 0.15.0 · fixed in 0.18.0

• ash-project/ash_typescript

  Version range not reported

References 4