CVE-2026-82733: CWE-209 Generation of Error Message Containing Sensitive Information in ash-project ash_typescript

The vulnerability arises because the dispatch/3 function in lib/ash_typescript/typed_controller/request_handler.ex passes unexpected return values to unexpected_return/2, which interpolates inspect(value, limit: 50) directly into the HTTP 500 response message. The inspect/2 function's limit option restricts elements per collection but does not limit the overall size, allowing full serialization of sensitive data structures like {:error, %User{}} or changesets. This behavior contradicts other error handling paths that gate detailed error messages behind a configuration flag, resulting in unintended exposure of sensitive information in error responses. The affected versions are ash_typescript 0.15.0 through versions before 0.18.0.

An unauthenticated attacker can receive HTTP 500 responses containing detailed internal data structures, including sensitive information such as hashed passwords, tokens, and tenant identifiers. This information disclosure can aid attackers in further attacks or data compromise. The vulnerability has a CVSS 4.0 base score of 6.3 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and partial confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is indicated in the provided data. Until a patch is available, users should consider implementing custom error handling to avoid exposing sensitive data in error messages or disable detailed error output in production environments.