CVE-2026-81852: CWE-330 Use of Insufficiently Random Values in ash-project ash_admin

The vulnerability arises because AshAdmin.Router.ash_admin/2 defaults the img, style, and script nonces to a fixed literal constant 'ash_admin-Ed55GFnX' when mounted without the :csp_nonce_assign_key option. AshAdmin.Layouts writes this constant nonce verbatim into the nonce attribute of inline <style> and <script> tags on every response. Since this nonce is publicly known and never rotated per request, any CSP script-src policy that allows this nonce can be bypassed by an attacker who can inject HTML on an admin page, enabling execution of inline scripts that the CSP was intended to block. The fix involves generating a fresh random nonce per request. The affected versions are from 0.10.8 before 1.3.1.

The impact is that the CSP protection intended to prevent inline script execution can be bypassed if an attacker can inject HTML into an admin page. This could allow execution of malicious inline scripts despite CSP policies. However, the CVSS score is low (2.1), indicating limited impact or exploitability. There are no known exploits in the wild.

No official fix or patch is currently documented. Users should upgrade to version 1.3.1 or later where the nonce is generated fresh per request. Until then, applications should avoid relying solely on the default nonce and consider additional protections against HTML injection on admin pages. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.