CVE-2026-77950: CWE-209 Generation of Error Message Containing Sensitive Information in ash-project ash_typescript

The vulnerability arises in the apply_error_handler/3 function in lib/ash_typescript/rpc/errors.ex, which is responsible for redacting or suppressing errors before they reach the client. Error handlers are typically pattern-matching functions for expected error shapes. If an error shape is unmatched, a FunctionClauseError is raised, and the raw error map, including any sensitive data in variables, is returned to the client. Additionally, the rescue clause only catches exceptions, so errors that throw or exit still propagate unredacted. This behavior can inadvertently expose sensitive internal error details to unauthenticated attackers.

An unauthenticated attacker can provoke errors that cause the system to return unredacted internal error data, potentially exposing sensitive information contained in error variables. This information disclosure can aid attackers in further reconnaissance or exploitation. The vulnerability does not require privileges or user interaction and has a low attack complexity, but the impact is limited to information disclosure without direct integrity or availability effects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, developers should carefully implement error handlers to cover all expected error shapes and avoid returning raw error data. Avoid relying solely on pattern matching for error suppression and consider additional safeguards to prevent leaking sensitive information in error responses.