The vulnerability arises from unsafe deserialization in the decode_values/2 function of lib/ash/page/keyset.ex, which uses non_executable_binary_to_term/2 with the [:safe] option. While this prevents new atoms, functions, and ports, it does not block structs built from already interned atoms, such as %Ash.Query.Call{}. This struct can be injected and spliced into the keyset filter expression without passing through the usual private/public gate checks. On AshPostgres, this leads to SQL injection by inlining the malicious fragment into the SQL query. On ETS and Simple data layers, the injected expression is evaluated as an arbitrary function call, enabling code execution. The flaw affects ash versions starting at 1.17.0 and prior to 3.31.3.

An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks on systems using the AshPostgres data layer, potentially compromising database integrity and confidentiality. On other data layers like ETS and Simple, the attacker can execute arbitrary code within the application process, leading to full compromise of the affected system. The vulnerability has a high severity score (CVSS 7.5) reflecting its potential for significant impact without requiring authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted input in keyset pagination cursors or disable keyset pagination features if possible. Monitor vendor channels for updates and apply patches promptly once released.