CVE-2026-105283: CWE-209 Generation of Error Message Containing Sensitive Information in ash-project ash_typescript

The vulnerability arises in AshTypescript.Rpc.ErrorBuilder.build_error_response/1, which renders pipeline error terms that do not match specific clauses using inspect/1, placing the output directly into the client-facing error details. While Ash exceptions have a redaction path, fallback error cases lack redaction, exposing internal Elixir terms in HTTP or channel responses. Two request paths are affected: one involving invalid nested struct-typed action arguments causing cast errors, and another involving field selection on generic actions returning primitives that expose full type structs. Resource module names are not considered sensitive and are out of scope. This affects ash_typescript versions >=0.1.0 and <0.19.1.

An unauthenticated attacker can obtain sensitive internal Elixir terms from RPC error responses, potentially revealing implementation details that could aid further attacks or information gathering. The exposure is limited to error message contents and does not include resource module names. There is no indication of active exploitation in the wild.

No explicit patch or remediation link is provided in the data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about exposing RPC error details and consider implementing custom error handling to redact sensitive information.