CVE-2026-82580: CWE-209 Generation of Error Message Containing Sensitive Information in ash-project ash_ai

The vulnerability arises from ash_ai's handling of exceptions in AshAi.ToolLoop and AshAi.Tools. When a tool raises an exception, its message is serialized verbatim into the tool-result content, which is appended to the conversation and sent back to the model, typically relayed to the user. Because no filtering or sanitization occurs before this, internal error details such as database constraint messages, adapter errors, query fragments, or policy internals are exposed directly to chat users who can trigger these errors. The fix involves routing raised tool errors through a safe formatter to prevent sensitive information leakage. This issue affects ash_ai versions from 0.6.0 before 1.0.0.

Sensitive internal error information can be disclosed to chat users, potentially revealing implementation details or internal system state that could aid an attacker in further exploitation or reconnaissance. The vulnerability does not require user interaction and can be triggered by steering tool arguments to cause exceptions. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has identified the issue and described a fix involving safe formatting of tool errors, but no official patch or update has been published. Until a fix is available, users should avoid exposing the affected versions in untrusted environments or restrict access to trusted users only.