ash vulnerabilities (Hex)
31 vulnerabilities.
-
ashHex An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records 7.6 High -
ashHex Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records 6.0 Medium -
ashHex Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts 6.0 Medium -
ashHex Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash 8.2 High -
ashHex Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash 5.9 Medium -
ashHex Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle 6.0 Medium -
ashHex Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length 5.9 Medium -
ashHex Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor 5.9 Medium -
ashHex Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records 5.9 Medium -
ashHex Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another 2.1 Low -
ashHex Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records 5.9 Medium -
ashHex ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness 5.9 Medium -
ashHex Ash.Reactor change step fails open, skipping a change when its where guard raises 2.1 Low -
ashHex Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads 2.1 Low -
ashHex Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory 5.9 Medium -
ashHex Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion 2.1 Low -
ashHex Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs 2.1 Low -
ashHex Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error 2.1 Low -
ashHex Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service 5.9 Medium -
ashHex Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads 5.9 Medium -
ashHex Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass 2.1 Low -
ashHex Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service 5.9 Medium -
ashHex Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal 2.1 Low -
ashHex Filter expression injection via forged keyset pagination cursor in Ash 7.5 High -
ashHex Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash 2.1 Low -
ashHex Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset 5.9 Medium -
ashHex Private action arguments can be set by user input in Ash 5.9 Medium -
ashHex Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash 8.2 High -
ashHex Authorization bypass when bypass policy condition evaluates to true 8.6 High -
ashHex Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization 8.6 High -
ashHex Before action hooks may execute in certain scenarios despite a request being forbidden 7.1 High