Aash-project

Products

Exploited and recent CVEs

• CVE-2026-96581 High 7.6 An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records 0.3%
• CVE-2026-115627 Medium 6.0 AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows 0.2%
• CVE-2026-115635 Medium 6.0 AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set 0.2%
• CVE-2026-114214 Medium 6.0 Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records 0.2%
• CVE-2026-105283 Medium 6.3 Internal error terms inspected into AshTypescript RPC error responses 0.4%
• CVE-2026-101028 Medium 6.0 Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts 0.3%
• CVE-2026-94201 High 8.2 Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash 0.3%
• CVE-2026-93477 Medium 5.9 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash 0.2%
• CVE-2026-86338 Medium 6.0 Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle 0.4%
• CVE-2026-78216 Medium 6.0 AshLua eval read operations can read field-policy-protected fields via aggregates 0.4%
• CVE-2026-78230 Medium 6.0 AshAi aggregate tool can read field-policy-protected fields 0.4%
• CVE-2026-82710 Low 2.3 Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata 0.7%
• CVE-2026-82584 Low 2.3 Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata 0.5%
• CVE-2026-82586 High 8.2 AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes 0.5%
• CVE-2026-81638 Low 2.1 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry 0.2%
• CVE-2026-82758 Medium 6.3 ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint 0.7%
• CVE-2026-82757 Medium 6.3 ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF 0.7%
• CVE-2026-82756 Medium 6.3 ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection 0.7%
• CVE-2026-82755 Medium 6.3 ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion 0.7%
• CVE-2026-82754 Medium 6.3 ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls 0.7%
• CVE-2026-82753 High 8.2 Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server 0.7%
• CVE-2026-82752 Medium 5.9 Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length 0.2%
• CVE-2026-82747 Medium 5.9 Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor 0.2%
• CVE-2026-82749 Medium 5.9 Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records 0.2%
• CVE-2026-82748 Low 2.1 Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another 0.2%
• CVE-2026-82746 Medium 5.9 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records 0.2%
• CVE-2026-82745 Medium 5.9 ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness 0.2%
• CVE-2026-82744 Low 2.1 Ash.Reactor change step fails open, skipping a change when its where guard raises 0.2%
• CVE-2026-82743 Low 2.1 Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads 0.2%
• CVE-2026-82742 Medium 5.9 Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory 0.2%