CVE-2026-82732Declared argument constraints not enforced on AshTypescript typed controller routes

Official description

Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ash_typescript/typed_controller/request_handler.ex calls Ash.Type.cast_input/3 and treats an {:ok, cast} result as fully validated. In Ash these are separate steps: cast_input/3 only coerces the term, while every constraint declared on the argument is applied by Ash.Type.apply_constraints/3, which this path never calls. Constraints such as one_of, max_length, min and max, and match are therefore inert, so a value outside a declared allowlist is accepted and passed to the route handler. Codegen renders the same constraints into the generated TypeScript types, so an allowlist appears enforced to a TypeScript caller while any other HTTP client ignores it. Empty-string to nil normalization also lives in apply_constraints, so the allow_nil?: false check accepts "" for a required argument. Where a constraint gates a role, a status, or a sort direction, this becomes a privilege or state-machine bypass. This issue affects ash_typescript: from 0.15.0 before 0.18.0.

Affected products (as reported)

References

• https://github.com/ash-project/ash_typescript/security/advisories/GHSA-f7fq-hwq6-jhvv related, vendor-advisory
• https://cna.erlef.org/cves/CVE-2026-82732.html related
• https://osv.dev/vulnerability/EEF-CVE-2026-82732 related
• https://github.com/ash-project/ash_typescript/commit/21ab6f1229a4dccdb56bc37ed437d9672a0c4a4e patch