CVE-2026-77850: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ash-project ash_admin

The vulnerability occurs in ash_admin's relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField. These components highlight matched search terms by wrapping them in <b> tags and render the entire string using Phoenix.HTML.raw/1, which disables output escaping. Since the highlighted value is derived from the destination record's label_field, which can contain content written by lower-privileged users, an attacker can inject malicious HTML/JavaScript (e.g., <img src=x onerror=...>) that executes in the administrator's browser when the matching record appears in the dropdown. This grants the attacker the administrator's privileges over all exposed ash_admin functionality. The fix involves HTML-escaping the label before inserting highlight markup to prevent script execution.

Successful exploitation allows an attacker to execute arbitrary JavaScript in an administrator's browser session, potentially leading to full administrative control over the ash_admin interface and all data and functions it exposes. This elevates the attacker's privileges and can compromise the confidentiality, integrity, and availability of the system managed by ash_admin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves HTML-escaping the label before inserting highlight markup to prevent script execution. Until an official fix is available, avoid using vulnerable versions or restrict access to trusted users only.