Ash-project vulnerabilities

Products

• Ash 31
• Ash Typescript 8
• Ash Admin 7
• Ash Ai 7
• Ash Authentication Oauth2 Server 6
• Ash Graphql 6
• Ash Sql 5
• Ash Phoenix 4
• Ash Postgres 4
• Ash Authentication Phoenix 3
• Ash Paper Trail 3
• Ash Cloak 2
• Ash Lua 2
• Ash Oban 2

Newest

• ash-project ash An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records CVE-2026-96581 Fix available 7.6 HighOctober 26, 2026
• ash-project ash postgres AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows CVE-2026-115627 Fix available 6.0 MediumOctober 25, 2026
• ash-project ash postgres AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set CVE-2026-115635 Fix available 6.0 MediumOctober 25, 2026
• ash-project ash Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records CVE-2026-114214 Fix available 6.0 MediumOctober 25, 2026
• ash-project ash typescript Internal error terms inspected into AshTypescript RPC error responses CVE-2026-105283 Fix available 6.3 MediumOctober 12, 2026
• ash-project ash Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts CVE-2026-101028 Fix available 6.0 MediumOctober 9, 2026
• ash-project ash Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash CVE-2026-94201 Fix available 8.2 HighOctober 5, 2026
• ash-project ash Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash CVE-2026-93477 Fix available 5.9 MediumSeptember 25, 2026
• ash-project ash authentication phoenix, team-alembic ash authentication +1 more Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix CVE-2026-86533 Fix available 9.1 CriticalSeptember 17, 2026
• ash-project ash authentication phoenix, team-alembic ash authentication +1 more Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix CVE-2026-81632 Fix available 7.2 HighSeptember 17, 2026
• ash-project ash Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle CVE-2026-86338 Fix available 6.0 MediumSeptember 16, 2026
• ash-project ash lua AshLua eval read operations can read field-policy-protected fields via aggregates CVE-2026-78216 Fix available 6.0 MediumSeptember 8, 2026
• ash-project ash ai AshAi aggregate tool can read field-policy-protected fields CVE-2026-78230 Fix available 6.0 MediumSeptember 8, 2026
• ash-project usage rules Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata CVE-2026-82710 Fix available 2.3 LowSeptember 8, 2026
• ash-project igniter Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata CVE-2026-82584 Fix available 2.3 LowSeptember 7, 2026
• ash-project ash lua AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes CVE-2026-82586 Fix available 8.2 HighSeptember 7, 2026
• ash-project ash double entry Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry CVE-2026-81638 Fix available 2.1 LowSeptember 7, 2026
• ash-project ash authentication oauth2 server ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint CVE-2026-82758 Fix available 6.3 MediumSeptember 7, 2026
• ash-project ash authentication oauth2 server ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF CVE-2026-82757 Fix available 6.3 MediumSeptember 7, 2026
• ash-project ash authentication oauth2 server ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection CVE-2026-82756 Fix available 6.3 MediumSeptember 7, 2026
• ash-project ash authentication oauth2 server ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion CVE-2026-82755 Fix available 6.3 MediumSeptember 7, 2026
• ash-project ash authentication oauth2 server ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls CVE-2026-82754 Fix available 6.3 MediumSeptember 7, 2026
• ash-project ash authentication oauth2 server Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server CVE-2026-82753 Fix available 8.2 HighSeptember 7, 2026
• ash-project ash Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length CVE-2026-82752 Fix available 5.9 MediumSeptember 5, 2026
• ash-project ash Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor CVE-2026-82747 Fix available 5.9 MediumSeptember 1, 2026
• ash-project ash Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records CVE-2026-82749 Fix available 5.9 MediumSeptember 1, 2026
• ash-project ash Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another CVE-2026-82748 Fix available 2.1 LowSeptember 1, 2026
• ash-project ash Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records CVE-2026-82746 Fix available 5.9 MediumSeptember 1, 2026
• ash-project ash ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness CVE-2026-82745 Fix available 5.9 MediumSeptember 1, 2026
• ash-project ash Ash.Reactor change step fails open, skipping a change when its where guard raises CVE-2026-82744 Fix available 2.1 LowSeptember 1, 2026
• ash-project ash Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads CVE-2026-82743 Fix available 2.1 LowSeptember 1, 2026
• ash-project ash Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory CVE-2026-82742 Fix available 5.9 MediumSeptember 1, 2026
• ash-project ash Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion CVE-2026-82741 Fix available 2.1 LowSeptember 1, 2026
• ash-project ash Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs CVE-2026-82740 Fix available 2.1 LowSeptember 1, 2026
• ash-project ash Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error CVE-2026-82739 Fix available 2.1 LowSeptember 1, 2026
• ash-project ash Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service CVE-2026-82738 Fix available 5.9 MediumSeptember 1, 2026
• ash-project ash Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads CVE-2026-82737 Fix available 5.9 MediumSeptember 1, 2026
• ash-project ash Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass CVE-2026-82736 Fix available 2.1 LowSeptember 1, 2026
• ash-project ash Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service CVE-2026-82735 Fix available 5.9 MediumSeptember 1, 2026
• ash-project ash Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal CVE-2026-82734 Fix available 2.1 LowSeptember 1, 2026
• ash-project ash typescript Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection CVE-2026-82731 Fix available 2.3 LowSeptember 1, 2026
• ash-project ash typescript Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter CVE-2026-74837 Fix available 8.7 HighSeptember 1, 2026
• ash-project ash typescript Route handler return value echoed into AshTypescript error response CVE-2026-82733 Fix available 6.3 MediumSeptember 1, 2026
• ash-project ash typescript Declared argument constraints not enforced on AshTypescript typed controller routes CVE-2026-82732 Fix available 6.3 MediumSeptember 1, 2026
• ash-project ash typescript Authorization-redacted field values disclosed through AshTypescript result normalization CVE-2026-82730 Fix available 8.2 HighSeptember 1, 2026
• ash-project ash typescript RPC error handler fails open in AshTypescript, disclosing unredacted errors CVE-2026-77950 Fix available 6.3 MediumSeptember 1, 2026
• ash-project ash typescript Unbounded atom creation from typed struct field names in AshTypescript field selector CVE-2026-77856 Fix available 8.2 HighSeptember 1, 2026
• ash-project ash phoenix AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data CVE-2026-82725 Fix available 2.3 LowAugust 31, 2026
• ash-project ash phoenix Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain CVE-2026-82724 Fix available 7.6 HighAugust 31, 2026
• ash-project ash phoenix AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant CVE-2026-82726 Fix available 6.3 MediumAugust 31, 2026
• Show olderLoading…