CVE-2026-80227: CWE-697 Incorrect Comparison in ash-project ash_sql

The vulnerability in ash_sql versions from 0.1.0 up to but not including 0.7.1 is due to a mismatch between how string trimming is implemented in SQL versus in-memory Elixir code. The SQL generated by string_trim/1 only removes literal space characters (codepoint 32) and leaves other whitespace characters intact, whereas Elixir's String.trim/1 removes all whitespace characters. This causes inconsistent behavior in trimmed uniqueness or equality checks depending on whether the expression is evaluated in the database or in memory, potentially allowing padded input to bypass intended uniqueness or equality constraints.

This vulnerability can lead to inconsistent behavior in applications using ash_sql, where padded string inputs with tabs, newlines, carriage returns, or form feeds may bypass trimmed uniqueness or equality checks in the database or in memory. This could result in near-duplicate entries or incorrect validation outcomes. The CVSS score is low (2.1), indicating limited impact and complexity.

No official fix or patch is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, be cautious about relying on trimmed uniqueness or equality checks that use string_trim/1 in ash_sql, and consider implementing additional validation or normalization of input strings to ensure consistent handling of whitespace characters.