# cve.now: Ash-project

The newest entries naming Ash-project as an affected vendor (up to 200), of 92 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119613](https://cve.now/CVE-2026-119613.md): AshAi sends unrecognized tool errors verbatim to MCP clients and the model, disclosing internal details (CVSS 5.3)
- [CVE-2026-96581](https://cve.now/CVE-2026-96581.md): An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records (CVSS 7.6)
- [CVE-2026-115627](https://cve.now/CVE-2026-115627.md): AshPostgres ignores attribute multitenancy on the join resource when loading many\_to\_many and through relationships, returning records related through other tenants' rows (CVSS 6.0)
- [CVE-2026-115635](https://cve.now/CVE-2026-115635.md): AshPostgres returns another tenant's record for a skipped upsert when return\_skipped\_upsert? is set (CVSS 6.0)
- [CVE-2026-114214](https://cve.now/CVE-2026-114214.md): Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records (CVSS 6.0)
- [CVE-2026-105283](https://cve.now/CVE-2026-105283.md): Internal error terms inspected into AshTypescript RPC error responses (CVSS 6.3)
- [CVE-2026-101028](https://cve.now/CVE-2026-101028.md): Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts (CVSS 6.0)
- [CVE-2026-94201](https://cve.now/CVE-2026-94201.md): Filtering an :atom attribute with unsafe\_to\_atom? can exhaust the BEAM atom table in Ash (CVSS 8.2)
- [CVE-2026-93477](https://cve.now/CVE-2026-93477.md): Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash (CVSS 5.9)
- [CVE-2026-86338](https://cve.now/CVE-2026-86338.md): Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle (CVSS 6.0)
- [CVE-2026-78216](https://cve.now/CVE-2026-78216.md): AshLua eval read operations can read field-policy-protected fields via aggregates (CVSS 6.0)
- [CVE-2026-78230](https://cve.now/CVE-2026-78230.md): AshAi aggregate tool can read field-policy-protected fields (CVSS 6.0)
- [CVE-2026-82710](https://cve.now/CVE-2026-82710.md): Terminal escape sequence injection in mix usage\_rules.search\_docs via package documentation metadata (CVSS 2.3)
- [CVE-2026-82584](https://cve.now/CVE-2026-82584.md): Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata (CVSS 2.3)
- [CVE-2026-82586](https://cve.now/CVE-2026-82586.md): AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes (CVSS 8.2)
- [CVE-2026-81638](https://cve.now/CVE-2026-81638.md): Non-canonical ULID spellings are accepted and alias to the same record in ash\_double\_entry (CVSS 2.1)
- [CVE-2026-82758](https://cve.now/CVE-2026-82758.md): ash\_authentication\_oauth2\_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint (CVSS 6.3)
- [CVE-2026-82757](https://cve.now/CVE-2026-82757.md): ash\_authentication\_oauth2\_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF (CVSS 6.3)
- [CVE-2026-82756](https://cve.now/CVE-2026-82756.md): ash\_authentication\_oauth2\_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection (CVSS 6.3)
- [CVE-2026-82755](https://cve.now/CVE-2026-82755.md): ash\_authentication\_oauth2\_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion (CVSS 6.3)
- [CVE-2026-82754](https://cve.now/CVE-2026-82754.md): ash\_authentication\_oauth2\_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls (CVSS 6.3)
- [CVE-2026-82753](https://cve.now/CVE-2026-82753.md): Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash\_authentication\_oauth2\_server (CVSS 8.2)
- [CVE-2026-82752](https://cve.now/CVE-2026-82752.md): Ash string length constraints count graphemes, so a combining-mark string of any size passes max\_length (CVSS 5.9)
- [CVE-2026-82747](https://cve.now/CVE-2026-82747.md): Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor (CVSS 5.9)
- [CVE-2026-82749](https://cve.now/CVE-2026-82749.md): Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records (CVSS 5.9)
- [CVE-2026-82748](https://cve.now/CVE-2026-82748.md): Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another (CVSS 2.1)
- [CVE-2026-82746](https://cve.now/CVE-2026-82746.md): Ash.update\_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records (CVSS 5.9)
- [CVE-2026-82745](https://cve.now/CVE-2026-82745.md): ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness (CVSS 5.9)
- [CVE-2026-82744](https://cve.now/CVE-2026-82744.md): Ash.Reactor change step fails open, skipping a change when its where guard raises (CVSS 2.1)
- [CVE-2026-82743](https://cve.now/CVE-2026-82743.md): Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads (CVSS 2.1)
- [CVE-2026-82742](https://cve.now/CVE-2026-82742.md): Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory (CVSS 5.9)
- [CVE-2026-82741](https://cve.now/CVE-2026-82741.md): Ash.Type.Union with :map\_with\_tag does not force the tag on dump, enabling tag confusion (CVSS 2.1)
- [CVE-2026-82740](https://cve.now/CVE-2026-82740.md): Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs (CVSS 2.1)
- [CVE-2026-82739](https://cve.now/CVE-2026-82739.md): Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error (CVSS 2.1)
- [CVE-2026-82738](https://cve.now/CVE-2026-82738.md): Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service (CVSS 5.9)
- [CVE-2026-82737](https://cve.now/CVE-2026-82737.md): Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads (CVSS 5.9)
- [CVE-2026-82736](https://cve.now/CVE-2026-82736.md): Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass (CVSS 2.1)
- [CVE-2026-82735](https://cve.now/CVE-2026-82735.md): Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service (CVSS 5.9)
- [CVE-2026-82734](https://cve.now/CVE-2026-82734.md): Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal (CVSS 2.1)
- [CVE-2026-82731](https://cve.now/CVE-2026-82731.md): Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection (CVSS 2.3)
- [CVE-2026-74837](https://cve.now/CVE-2026-74837.md): Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter (CVSS 8.7)
- [CVE-2026-82733](https://cve.now/CVE-2026-82733.md): Route handler return value echoed into AshTypescript error response (CVSS 6.3)
- [CVE-2026-82732](https://cve.now/CVE-2026-82732.md): Declared argument constraints not enforced on AshTypescript typed controller routes (CVSS 6.3)
- [CVE-2026-82730](https://cve.now/CVE-2026-82730.md): Authorization-redacted field values disclosed through AshTypescript result normalization (CVSS 8.2)
- [CVE-2026-77950](https://cve.now/CVE-2026-77950.md): RPC error handler fails open in AshTypescript, disclosing unredacted errors (CVSS 6.3)
- [CVE-2026-77856](https://cve.now/CVE-2026-77856.md): Unbounded atom creation from typed struct field names in AshTypescript field selector (CVSS 8.2)
- [CVE-2026-82725](https://cve.now/CVE-2026-82725.md): AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data (CVSS 2.3)
- [CVE-2026-82724](https://cve.now/CVE-2026-82724.md): Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle\_subdomain (CVSS 7.6)
- [CVE-2026-82726](https://cve.now/CVE-2026-82726.md): AshPhoenix get\_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant (CVSS 6.3)
- [CVE-2026-82727](https://cve.now/CVE-2026-82727.md): AshPhoenix Form.Auto leaks submitted params in an unknown \_union\_type error message (CVSS 2.3)
- [CVE-2026-82673](https://cve.now/CVE-2026-82673.md): Path traversal in AshAdmin file uploads via unsanitized client filename (CVSS 8.3)
- [CVE-2026-81853](https://cve.now/CVE-2026-81853.md): AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle (CVSS 2.3)
- [CVE-2026-81852](https://cve.now/CVE-2026-81852.md): AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass (CVSS 2.1)
- [CVE-2026-82681](https://cve.now/CVE-2026-82681.md): Query-parameter injection in AshAdmin row-action links via unencoded string primary keys (CVSS 2.0)
- [CVE-2026-77850](https://cve.now/CVE-2026-77850.md): Stored XSS in AshAdmin relationship typeahead via unescaped label\_field content (CVSS 8.4)
- [CVE-2026-82722](https://cve.now/CVE-2026-82722.md): AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS) (CVSS 8.3)
- [CVE-2026-75757](https://cve.now/CVE-2026-75757.md): AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain (CVSS 8.3)
- [CVE-2026-75760](https://cve.now/CVE-2026-75760.md): AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error (CVSS 7.1)
- [CVE-2026-82580](https://cve.now/CVE-2026-82580.md): AshAi echoes raw tool exception messages into the conversation, disclosing internal details (CVSS 5.3)
- [CVE-2026-82579](https://cve.now/CVE-2026-82579.md): AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service (CVSS 6.0)
- [CVE-2026-82564](https://cve.now/CVE-2026-82564.md): Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records (CVSS 7.1)
- [CVE-2026-81315](https://cve.now/CVE-2026-81315.md): MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header (CVSS 7.4)
- [CVE-2026-77956](https://cve.now/CVE-2026-77956.md): EEx template evaluation of prompt content in AshAi enables remote code execution (CVSS 8.9)
- [CVE-2026-78693](https://cve.now/CVE-2026-78693.md): Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names (CVSS 6.9)
- [CVE-2026-80223](https://cve.now/CVE-2026-80223.md): Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read (CVSS 7.1)
- [CVE-2026-81636](https://cve.now/CVE-2026-81636.md): Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service (CVSS 8.7)
- [CVE-2026-81633](https://cve.now/CVE-2026-81633.md): Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment (CVSS 6.9)
- [CVE-2026-81643](https://cve.now/CVE-2026-81643.md): Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification (CVSS 2.3)
- [CVE-2026-82367](https://cve.now/CVE-2026-82367.md): Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic (CVSS 2.3)
- [CVE-2026-81322](https://cve.now/CVE-2026-81322.md): Cloaked plaintext leaks through a non-sensitive action argument in AshCloak (CVSS 2.1)
- [CVE-2026-81319](https://cve.now/CVE-2026-81319.md): Unsafe deserialization of decrypted terms enables node DoS in AshCloak (CVSS 5.9)
- [CVE-2026-78699](https://cve.now/CVE-2026-78699.md): rename\_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres (CVSS 7.2)
- [CVE-2026-77454](https://cve.now/CVE-2026-77454.md): exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql (CVSS 5.9)
- [CVE-2026-81316](https://cve.now/CVE-2026-81316.md): Same-named aggregates with differing filters are conflated in AshSql (CVSS 2.1)
- [CVE-2026-81318](https://cve.now/CVE-2026-81318.md): Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql (CVSS 2.1)
- [CVE-2026-78691](https://cve.now/CVE-2026-78691.md): Unescaped backslash allows LIKE wildcard injection in AshSql string search (CVSS 2.1)
- [CVE-2026-80227](https://cve.now/CVE-2026-80227.md): SQL string\_trim removes only spaces, diverging from in-memory trimming in AshSql (CVSS 2.1)
- [CVE-2026-78228](https://cve.now/CVE-2026-78228.md): Unbounded handle\_error recursion enables denial of service in AshOban triggers (CVSS 5.9)
- [CVE-2026-78038](https://cve.now/CVE-2026-78038.md): Job argument injection via :args overrides primary\_key and tenant in AshOban (CVSS 5.9)
- [CVE-2026-77846](https://cve.now/CVE-2026-77846.md): JSON path injection via unescaped get\_path segments in AshSqlite (CVSS 2.1)
- [CVE-2026-77831](https://cve.now/CVE-2026-77831.md): Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking (CVSS 2.1)
- [CVE-2026-77970](https://cve.now/CVE-2026-77970.md): Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions (CVSS 5.9)
- [CVE-2026-75847](https://cve.now/CVE-2026-75847.md): Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail (CVSS 5.9)
- [CVE-2026-67579](https://cve.now/CVE-2026-67579.md): Filter expression injection via forged keyset pagination cursor in Ash (CVSS 7.5)
- [CVE-2026-70395](https://cve.now/CVE-2026-70395.md): Predicate injection in manage\_relationship belongs\_to lookup discloses secret lookup keys in Ash (CVSS 2.1)
- [CVE-2026-69659](https://cve.now/CVE-2026-69659.md): Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset (CVSS 5.9)
- [CVE-2026-55736](https://cve.now/CVE-2026-55736.md): Private action arguments can be set by user input in Ash (CVSS 5.9)
- [CVE-2026-34593](https://cve.now/CVE-2026-34593.md): Ash Framework: Ash.Type.Module.cast\_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash (CVSS 8.2)
- [CVE-2025-48044](https://cve.now/CVE-2025-48044.md): Authorization bypass when bypass policy condition evaluates to true (CVSS 8.6)
- [CVE-2025-48043](https://cve.now/CVE-2025-48043.md): Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization (CVSS 8.6)
- [CVE-2025-48042](https://cve.now/CVE-2025-48042.md): Before action hooks may execute in certain scenarios despite a request being forbidden (CVSS 7.1)
- [CVE-2024-49756](https://cve.now/CVE-2024-49756.md): AshPostgres empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability. (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/ash-project
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.