Ash-project vulnerabilities
92 CVEs and advisories name Ash-project as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-82564Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records
- CVE-2026-81315MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header
- CVE-2026-77956EEx template evaluation of prompt content in AshAi enables remote code execution
- CVE-2026-78693Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names
- CVE-2026-80223Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read
- CVE-2026-81636Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service
- CVE-2026-81633Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment
- CVE-2026-81643Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification
- CVE-2026-82367Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic
- CVE-2026-81322Cloaked plaintext leaks through a non-sensitive action argument in AshCloak
- CVE-2026-81319Unsafe deserialization of decrypted terms enables node DoS in AshCloak
- CVE-2026-78699rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres
- CVE-2026-77454exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql
- CVE-2026-81316Same-named aggregates with differing filters are conflated in AshSql
- CVE-2026-81318Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql
- CVE-2026-78691Unescaped backslash allows LIKE wildcard injection in AshSql string search
- CVE-2026-80227SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql
- CVE-2026-78228Unbounded handle_error recursion enables denial of service in AshOban triggers
- CVE-2026-78038Job argument injection via :args overrides primary_key and tenant in AshOban
- CVE-2026-77846JSON path injection via unescaped get_path segments in AshSqlite
- CVE-2026-77831Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking
- CVE-2026-77970Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions
- CVE-2026-75847Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail
- CVE-2026-67579Filter expression injection via forged keyset pagination cursor in Ash
- CVE-2026-70395Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash
- CVE-2026-69659Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset
- CVE-2026-55736Private action arguments can be set by user input in Ash
- CVE-2026-34593Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash
- CVE-2025-48044Authorization bypass when bypass policy condition evaluates to true
- CVE-2025-48043Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization