Ash-Project
68 CVEs across 18 Ash-Project products. Browse Ash-Project vulnerabilities, severities, and proof-of-concept exploits.
Ash-Project products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93477 | | 2026-09-25 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private act… | |
CVE-2026-86338 | | 2026-09-16 | Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is r… | |
CVE-2026-78230 | | 2026-09-08 | AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Quer… | |
CVE-2026-78216 | | 2026-09-08 | AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad… | |
CVE-2026-82710 | | 2026-09-08 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal… | |
CVE-2026-82758 | | 2026-09-07 | Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dy… | |
CVE-2026-82757 | | 2026-09-07 | Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its… | |
CVE-2026-82756 | | 2026-09-07 | Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary au… | |
CVE-2026-82754 | | 2026-09-07 | Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an uninten… | |
CVE-2026-82586 | | 2026-09-07 | Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-fie… | |
CVE-2026-82584 | | 2026-09-07 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix ignite… | |
CVE-2026-81638 | | 2026-09-07 | Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the sam… | |
CVE-2026-82752 | | 2026-09-05 | Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose… | |
CVE-2026-82747 | | 2026-09-01 | Incorrect Authorization vulnerability in ash-project ash returns records that a runtime read policy denies to any actor. When a resource has an access_type :r… | |
CVE-2026-82749 | | 2026-09-01 | Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent(...) scoping filter to match unintended records when the referenced par… | |
CVE-2026-82748 | | 2026-09-01 | Incorrect Authorization vulnerability in ash-project ash authorizes an aggregate under one read action while computing it under another, so an aggregate can ru… | |
CVE-2026-82746 | | 2026-09-01 | Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_m… | |
CVE-2026-82745 | | 2026-09-01 | Improper Access Control vulnerability in ash-project ash lets a create action overwrite an existing record when the ETS or Mnesia data layer is used, because n… | |
CVE-2026-82744 | | 2026-09-01 | Not Failing Securely (Failing Open) vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run… | |
CVE-2026-82743 | | 2026-09-01 | Uncontrolled Resource Consumption vulnerability in ash-project ash lets a slow asynchronous read spin a scheduler thread at full CPU while the framework waits… | |
CVE-2026-82742 | | 2026-09-01 | Uncontrolled Resource Consumption vulnerability in ash-project ash lets an attacker exhaust node memory by matching a filter that spans multiple to-many relati… | |
CVE-2026-82741 | | 2026-09-01 | Improper Validation of Specified Type of Input vulnerability in ash-project ash lets an attacker confuse the stored type tag of an Ash.Type.Union value that us… | |
CVE-2026-82740 | | 2026-09-01 | Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested {:array, {:array, type}} attribute… | |
CVE-2026-82739 | | 2026-09-01 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who f… | |
CVE-2026-82738 | | 2026-09-01 | Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash… | |
CVE-2026-82737 | | 2026-09-01 | Integer Overflow or Wraparound vulnerability in ash-project ash lets an attacker corrupt a stored vector and crash later reads of it by submitting a vector wit… | |
CVE-2026-82736 | | 2026-09-01 | Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates it… | |
CVE-2026-82735 | | 2026-09-01 | Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to force an expensive regular expression to run on input that a length co… | |
CVE-2026-82734 | | 2026-09-01 | Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numer… | |
CVE-2026-82733 | | 2026-09-01 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal ap… | |
CVE-2026-82732 | | 2026-09-01 | Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound… | |
CVE-2026-82731 | | 2026-09-01 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redir… | |
CVE-2026-82730 | | 2026-09-01 | Incorrect Authorization vulnerability in ash-project ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. … | |
CVE-2026-77950 | | 2026-09-01 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredact… | |
CVE-2026-77856 | | 2026-09-01 | Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom ta… | |
CVE-2026-74837 | | 2026-09-01 | Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom ta… | |
CVE-2026-82726 | | 2026-08-31 | Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request… | |
CVE-2026-82725 | | 2026-08-31 | Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across re… | |
CVE-2026-82722 | | 2026-08-31 | Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM… | |
CVE-2026-82681 | | 2026-08-31 | Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record's string primary key rewrite the target o… | |
CVE-2026-81853 | | 2026-08-31 | Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attrib… | |
CVE-2026-82580 | | 2026-08-31 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat users. In AshAi.ToolLoo… | |
CVE-2026-82579 | | 2026-08-31 | Loop with Unreachable Exit Condition (Infinite Loop) vulnerability in ash-project ash_ai allows an attacker who can influence a model's output to hang the tool… | |
CVE-2026-82564 | | 2026-08-31 | Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to update or destroy record… | |
CVE-2026-75760 | | 2026-08-31 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-fac… | |
CVE-2026-77956 | | 2026-08-31 | Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir… | |
CVE-2026-81636 | | 2026-08-30 | Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_graphql allows an unauthenticated client to bypass the configured GraphQL… | |
CVE-2026-81633 | | 2026-08-30 | Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client to crash a relay node(id: ...) query with an unhandled KeyE… | |
CVE-2026-80223 | | 2026-08-30 | Incorrect Authorization vulnerability in ash-project ash_graphql allows an authenticated subscriber in one tenant to receive another tenant's records over Grap… | |
CVE-2026-78693 | | 2026-08-30 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that… | |
CVE-2026-81319 | | 2026-08-30 | Deserialization of Untrusted Data vulnerability in ash-project ash_cloak allows an attacker who can influence the bytes of an encrypted column to crash the BEA… | |
CVE-2026-78699 | | 2026-08-30 | Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that collides with an existing tenant's… | |
CVE-2026-81316 | | 2026-08-30 | Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should… | |
CVE-2026-80227 | | 2026-08-30 | Incorrect Comparison vulnerability in ash-project ash_sql allows a user to pad a string field with tab, newline, carriage-return, or form-feed characters and p… | |
CVE-2026-78038 | | 2026-08-30 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose input reaches the :arg… | |
CVE-2026-77454 | | 2026-08-30 | Incorrect Authorization vulnerability in ash-project ash_sql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relations… | |
CVE-2026-77846 | | 2026-08-30 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash_sqlite allows an attacker who controls a get_path/2 segment to… | |
CVE-2026-75847 | | 2026-08-30 | Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource t… | |
CVE-2026-67579 | High | 7.4 | 2026-08-12 | Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pag… |
CVE-2026-70395 | | 2026-08-09 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they ca… | |
CVE-2026-69659 | Medium | 5.5 | 2026-08-09 | Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the memory of the node via a crafted keyset pagination cursor… |
CVE-2026-55736 | | 2026-06-23 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private act… | |
CVE-2026-34593 | High | 7.5 | 2026-04-02 | Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type.Module.cast_input/2 unconditionally cr… |
CVE-2025-48044 | | 2025-10-17 | Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This issue affects ash: from 3.6.3 before 3.7.1. | |
CVE-2025-48043 | | 2025-10-10 | Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This issue affects ash: from 0.1.1 before 3.6.2. | |
CVE-2025-48042 | | 2025-09-07 | Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ash: from… | |
CVE-2025-4754 | | 2025-06-17 | Insufficient Session Expiration vulnerability in team-alembic ash_authentication_phoenix allows a session token captured before sign-out to remain usable after… | |
CVE-2024-49756 | Medium | 5.3 | 2024-10-23 | AshPostgres is the PostgreSQL data layer for Ash Framework. Starting in version 2.0.0 and prior to version 2.4.10, in certain very specific situations, it was… |