ash_ai vulnerabilities (Hex)
7 vulnerabilities.
-
ash_aiHex AshAi aggregate tool can read field-policy-protected fields 6.0 Medium -
ash_aiHex AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error 7.1 High -
ash_aiHex AshAi echoes raw tool exception messages into the conversation, disclosing internal details 5.3 Medium -
ash_aiHex AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service 6.0 Medium -
ash_aiHex Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records 7.1 High -
ash_aiHex MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header 7.4 High -
ash_aiHex EEx template evaluation of prompt content in AshAi enables remote code execution 8.9 High