{"id":"CVE-2026-77956","aliases":["EEF-CVE-2026-77956","EUVD-2026-68303","GHSA-2g59-hg7m-qc83"],"status":"published","title":"EEx template evaluation of prompt content in AshAi enables remote code execution","description":"Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code.\n\nAshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -\u003e ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as \u003c%= System.cmd(...) %\u003e therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.\n\nThis issue affects ash_ai: from 0.1.0 before 1.0.0.","severity":{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00282,"percentile":0.20922,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2026-08-31T00:56:26Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"Hex","package":"ash_ai","fixed_in":["1.0.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Hex","package":"ash_ai","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.0"},{"fixed":"1.0.0"}]}],"versions":["0.1.0","0.1.1","0.1.10","0.1.11","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.2.1","0.2.10","0.2.11","0.2.12","0.2.13","0.2.14","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.2.8","0.2.9","0.3.0","0.4.0","0.5.0","0.6.0","0.6.1","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.2"]}],"products":[{"vendor":"ash-project","product":"ash_ai"}],"references":[{"url":"https://github.com/ash-project/ash_ai/security/advisories/GHSA-2g59-hg7m-qc83","tags":["vendor-advisory","related","exploit","advisory"]},{"url":"https://cna.erlef.org/cves/CVE-2026-77956.html","tags":["related","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-77956","tags":["related","web"]},{"url":"https://github.com/ash-project/ash_ai/commit/e9948254b5659c1143b73dc2f59f457931e64514","tags":["patch","fix"]},{"url":"https://github.com","tags":["web"]},{"url":"https://repo.hex.pm","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77956.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77956","tags":["advisory"]},{"url":"https://github.com/ash-project/ash_ai","tags":["package"]},{"url":"https://hex.pm/packages/ash_ai","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-77956","title":"EEx template evaluation of prompt content in AshAi enables remote code execution","description":"Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code.\n\nAshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -\u003e ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as \u003c%= System.cmd(...) %\u003e therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.\n\nThis issue affects ash_ai: from 0.1.0 before 1.0.0.","status":"published","published":"2026-08-31T00:56:26.44Z","modified":"2026-08-31T16:01:41.879Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:20:15.712761Z"}],"euvd":[{"id":"EUVD-2026-68303","description":"Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code.\n\nAshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -\u003e ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as \u003c%= System.cmd(...) %\u003e therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.\n\nThis issue affects ash_ai: from 0.1.0 before 1.0.0.","status":"published","published":"2026-08-31T00:56:26Z","modified":"2026-08-31T16:01:41Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-02T18:01:20.704822Z"}],"nvd":[{"id":"CVE-2026-77956","description":"Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code.\n\nAshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -\u003e ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as \u003c%= System.cmd(...) %\u003e therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.\n\nThis issue affects ash_ai: from 0.1.0 before 1.0.0.","status":"published","published":"2026-08-31T01:16:49.563Z","modified":"2026-09-01T21:15:00.147Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:42.691315Z"}],"osv":[{"id":"CVE-2026-77956","title":"EEx template evaluation of prompt content in AshAi enables remote code execution","description":"Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code.\n\nAshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -\u003e ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as \u003c%= System.cmd(...) %\u003e therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.\n\nThis issue affects ash_ai: from 0.1.0 before 1.0.0.","status":"published","published":"2026-08-31T00:56:26.44Z","modified":"2026-10-28T02:30:36.092767981Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:45:17.44708Z"},{"id":"EEF-CVE-2026-77956","title":"EEx template evaluation of prompt content in AshAi enables remote code execution","description":"## Summary\n\nImproper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code.\n\n`AshAi.Actions.Prompt` evaluates prompt content through `EEx.eval_string/2`. The documented `prompt: fn input, context -\u003e ... end` form lets the prompt content be built from action arguments, so when a `prompt` action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as `\u003c%= System.cmd(...) %\u003e` therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.\n\nThis issue affects ash_ai: from 0.1.0 before 1.0.0.","status":"published","published":"2026-08-31T00:56:26.44Z","modified":"2026-09-08T03:45:06.382856399Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:33.520522Z"}]}}