Ash-project vulnerabilities
92 CVEs and advisories name Ash-project as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-119613AshAi sends unrecognized tool errors verbatim to MCP clients and the model, disclosing internal details
- CVE-2026-96581An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records
- CVE-2026-115627AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows
- CVE-2026-115635AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set
- CVE-2026-114214Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records
- CVE-2026-105283Internal error terms inspected into AshTypescript RPC error responses
- CVE-2026-101028Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts
- CVE-2026-94201Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash
- CVE-2026-93477Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash
- CVE-2026-86338Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle
- CVE-2026-78216AshLua eval read operations can read field-policy-protected fields via aggregates
- CVE-2026-78230AshAi aggregate tool can read field-policy-protected fields
- CVE-2026-82710Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata
- CVE-2026-82584Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
- CVE-2026-82586AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes
- CVE-2026-81638Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
- CVE-2026-82758ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint
- CVE-2026-82757ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
- CVE-2026-82756ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection
- CVE-2026-82755ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion
- CVE-2026-82754ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls
- CVE-2026-82753Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server
- CVE-2026-82752Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length
- CVE-2026-82747Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
- CVE-2026-82749Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records
- CVE-2026-82748Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another
- CVE-2026-82746Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records
- CVE-2026-82745ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness
- CVE-2026-82744Ash.Reactor change step fails open, skipping a change when its where guard raises
- CVE-2026-82743Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads