Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

ash_typescript

8 known vulnerabilities (3 high, 4 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 3 high, 4 medium, 1 low
Registry
Hex

Advisories 8

  • CVE-2026-105283Medium 6.3

    Internal error terms inspected into AshTypescript RPC error responses

    Affected: from 0.1.0, fixed in 0.19.1.

  • Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection

    Affected: from 0.15.0, fixed in 0.18.0; from 0.15.0, fixed in 0.18.0.

  • Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter

    Affected: from 0.1.0, fixed in 0.18.0; from 0.1.0, fixed in 0.18.0.

  • CVE-2026-82733Medium 6.3

    Route handler return value echoed into AshTypescript error response

    Affected: from 0.15.0, fixed in 0.18.0; from 0.15.0, fixed in 0.18.0.

  • CVE-2026-82732Medium 6.3

    Declared argument constraints not enforced on AshTypescript typed controller routes

    Affected: from 0.15.0, fixed in 0.18.0; from 0.15.0, fixed in 0.18.0.

  • Authorization-redacted field values disclosed through AshTypescript result normalization

    Affected: from 0.11.0, fixed in 0.18.0; from 0.11.0, fixed in 0.18.0.

  • CVE-2026-77950Medium 6.3

    RPC error handler fails open in AshTypescript, disclosing unredacted errors

    Affected: from 0.8.0, fixed in 0.18.0; from 0.8.0, fixed in 0.18.0.

  • Unbounded atom creation from typed struct field names in AshTypescript field selector

    Affected: from 0.11.0, fixed in 0.18.0; from 0.11.0, fixed in 0.18.0.