Ash-project vulnerabilities
92 CVEs and advisories name Ash-project as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-82742Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory
- CVE-2026-82741Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion
- CVE-2026-82740Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs
- CVE-2026-82739Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error
- CVE-2026-82738Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service
- CVE-2026-82737Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads
- CVE-2026-82736Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass
- CVE-2026-82735Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service
- CVE-2026-82734Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal
- CVE-2026-82731Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection
- CVE-2026-74837Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter
- CVE-2026-82733Route handler return value echoed into AshTypescript error response
- CVE-2026-82732Declared argument constraints not enforced on AshTypescript typed controller routes
- CVE-2026-82730Authorization-redacted field values disclosed through AshTypescript result normalization
- CVE-2026-77950RPC error handler fails open in AshTypescript, disclosing unredacted errors
- CVE-2026-77856Unbounded atom creation from typed struct field names in AshTypescript field selector
- CVE-2026-82725AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data
- CVE-2026-82724Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain
- CVE-2026-82726AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant
- CVE-2026-82727AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message
- CVE-2026-82673Path traversal in AshAdmin file uploads via unsanitized client filename
- CVE-2026-81853AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle
- CVE-2026-81852AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass
- CVE-2026-82681Query-parameter injection in AshAdmin row-action links via unencoded string primary keys
- CVE-2026-77850Stored XSS in AshAdmin relationship typeahead via unescaped label_field content
- CVE-2026-82722AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)
- CVE-2026-75757AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain
- CVE-2026-75760AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error
- CVE-2026-82580AshAi echoes raw tool exception messages into the conversation, disclosing internal details
- CVE-2026-82579AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service