Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names.
resolve_typed_struct_field/2 in lib/ash_typescript/rpc/field_processing/field_selector.ex looks a client-supplied field name up in the typed struct's reverse map and, when it finds no match, falls back to String.to_atom/1. Because this runs before any field-existence check, an unresolvable name mints a permanent atom rather than being rejected as unknown. Atoms are never garbage collected, so a request carrying many distinct names on a typed struct field grows the atom table until the VM aborts at its limit.
This issue affects ash_typescript: from 0.11.0 before 0.18.0.
CVE-2026-82725 is an authorization bypass vulnerability in ash-project's ash_phoenix component. It allows an attacker controlling filter form parameters to access private related data by filtering across relationships marked non-public. The vulnerability arises because the filtering logic resolves user-supplied relationship paths without enforcing public-only checks on intermediate relationships, only on the terminal field. This issue affects versions from 0.6.0-rc.1 up to but not including 2.3.25.
CVE-2026-82724 is an incorrect authorization vulnerability in ash-project's ash_phoenix component. The issue arises because the SubdomainHook authorization callback is invoked with a nil tenant, causing tenant-scoped access checks to fail. This happens due to the tenant assignment occurring after the authorization check, leading to either crashes or permissive access. The vulnerability affects versions from 2.1.26 up to but not including 2.3.25.
CVE-2026-82726 is a medium severity vulnerability in ash-project's ash_phoenix component. It involves a permissive regular expression used to parse the Host header, allowing a remote client to manipulate tenant selection or degrade requests by sending crafted Host headers. The root host pattern was interpolated unsafely, causing unintended matches and case sensitivity issues. This affects versions from 2.1.26 up to but not including 2.3.25.
CVE-2026-82727 is a vulnerability in ash-project's ash_phoenix component where error messages generated during form processing leak sensitive information. Specifically, when a union sub-form receives an unexpected _union_type value, the entire submitted parameter map, including secrets like passwords, is embedded in the exception message. This sensitive data is exposed in logs, crash reports, and developer error pages because the message bypasses Phoenix's parameter filtering. The issue affects versions from 1.2.17 up to but not including 2.3.25.
CVE-2026-82673 is a path traversal vulnerability in ash-project's ash_admin component that allows an attacker to write files to arbitrary paths on the server. The vulnerability arises because the filename supplied by the browser is not sanitized before being joined with a temporary directory path, enabling directory traversal. This can lead to arbitrary file writes and potentially remote code execution by overwriting critical application or system files. The issue affects versions from 0.13.7 up to but not including 1.3.1. The vulnerability has a high severity score of 8.3 CVSS 4.0.
CVE-2026-81853 is an authorization bypass vulnerability in ash-project's ash_admin component. It arises from improper validation of user-controlled keys in the decode_primary_key/2 function, allowing attackers to manipulate record lookup filters with arbitrary attributes. This can enable brute-force guessing of sensitive attribute values such as API tokens. The vulnerability affects versions from 0.1.0 up to but not including 1.3.1. The issue has a low CVSS score of 2.3 and no known exploits in the wild.
CVE-2026-81852 is a vulnerability in ash-project's ash_admin component where a hardcoded, publicly known Content-Security-Policy (CSP) nonce is used. This nonce is a compile-time constant that is not rotated per request, allowing an attacker who can inject HTML on an admin page to reuse the known nonce to bypass CSP protections against inline scripts. The issue affects versions from 0.10.8 up to but not including 1.3.1. The vulnerability has a low severity score and no known exploits in the wild.
CVE-2026-82681 is an improper encoding or escaping of output vulnerability in ash-project's ash_admin component. It allows an attacker controlling a record's string primary key to manipulate row-action URLs by injecting crafted query parameters. This occurs because the primary key and other parameters are interpolated into URLs without URL-encoding, enabling parameter injection that can alter the intended action of links. The vulnerability affects versions from 0.3.0-rc.0 before 1.3.1 of ash_admin.
CVE-2026-77850 is a stored Cross-site Scripting (XSS) vulnerability in the ash-project ash_admin component. It arises from improper neutralization of input during web page generation, specifically in relationship typeahead components that render database content without proper escaping. This allows attacker-supplied content to execute as script in an administrator's browser. The vulnerability affects versions from 0.13.0 up to but not including 1.3.1.
CVE-2026-82722 is a high-severity vulnerability in ash-project's ash_admin component that allows any client able to reach the admin LiveView to exhaust the BEAM atom table and crash the entire Erlang VM node. The issue arises because two LiveView event handlers intern atoms from unvalidated client input, which leads to unbounded atom creation. Since atoms are not garbage collected and the atom table has a fixed size, flooding these handlers with random input causes the VM to abort. This vulnerability affects ash_admin versions from 0.1.0 up to but not including 1.3.1.
CVE-2026-75757 is a high-severity vulnerability in ash-project's ash_admin component affecting versions from 0.9.1 up to but not including 1.3.1. The issue arises from reliance on cookies without proper validation and integrity checking, allowing an attacker controlling a sibling subdomain to rebind an admin's session to a different actor, tenant, or authorization mode. This occurs because the client JavaScript matches cookie names using an unanchored regular expression, enabling shadowing cookies from sibling subdomains to interfere with session parameters. The vulnerability is classified under CWE-565.
CVE-2026-75760 is a vulnerability in ash-project's ash_ai component that causes error messages to leak sensitive information. When the embedding provider call fails in AshAi.Changes.Vectorize, the error message includes unsanitized details such as the request URL, provider response body, and potentially the Authorization header containing the API key. This information is exposed to users via validation errors. The issue affects versions from 0.1.0 up to but not including 1.0.0. The vulnerability has a high severity score of 7.1.
CVE-2026-82580 is a vulnerability in ash-project ash_ai where internal error messages containing sensitive information are disclosed to chat users. This occurs because exceptions raised during tool execution are serialized and sent back to the user without filtering. The issue affects versions from 0.6.0 up to but not including 1.0.0. The vulnerability has a medium severity score of 5.3. No official patch or remediation guidance is currently available.
CVE-2026-82579 is an infinite loop vulnerability in the ash_ai tool of the ash-project. The vulnerability occurs when the tool loop processes model responses that result in an empty list after filtering, causing the loop to recurse indefinitely without advancing the conversation. This can lead to unbounded repeated model requests, potentially hanging the tool. The issue affects versions from 0.6.0 up to but not including 1.0.0.
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table.
In AshAi.Tool.Execution, identity_filter/3 built the update/destroy filter directly from the raw tool arguments as [{key, Map.get(arguments, to_string(key))}] and passed it to Ash.Query.do_filter/2. A map value is parsed as a predicate expression rather than a literal, so a caller can send {"public_ref": {"not_eq": "<own-ref>"}} and, combined with Ash.Query.limit(1) and Ash.bulk_update!/Ash.bulk_destroy!, retarget the write at a record it never identified; an omitted key yields an IS NULL filter that matches an arbitrary row. The fix casts each identity value to the field type, rejecting non-scalar inputs.
This issue affects ash_ai: from 0.6.0 before 1.0.0.
CVE-2026-81315 is an origin validation error vulnerability in ash-project's ash_ai server component that allows a malicious web page to bypass DNS-rebinding protections. The vulnerability arises because the server trusts the Host header and X-Forwarded-Proto header without proper validation, enabling an attacker to issue cross-site requests to a user's local MCP server with that user's privileges. This affects ash_ai versions from 0.8.0 up to but not including 1.0.0. The default configuration is insecure, but the fix involves restricting trusted origins to localhost and requiring an explicit allowlist for others.
CVE-2026-77956 is a high-severity code injection vulnerability in ash-project's ash_ai component. It allows a remote, unauthenticated attacker to execute arbitrary Elixir code by exploiting the evaluation of prompt content as EEx templates. The vulnerability affects versions from 0.1.0 up to but not including 1.0.0. The issue arises because attacker-controlled input can be compiled and executed on the server without authentication. The fix involves stopping the evaluation of function-supplied prompt content as EEx templates, limiting evaluation to statically configured templates only.
CVE-2026-78693 is a vulnerability in ash-project's ash_graphql component that causes error messages to expose internal field names despite application-level redaction configurations. This occurs because the error handling mechanism reinjects internal attribute and argument names into error paths when no field name mapping is configured, leading to leakage of sensitive internal information. The issue affects versions from 1.9.0 up to but not including 1.11.0. The vulnerability has a medium severity score of 6.9 and does not currently have an official patch or remediation guidance.
CVE-2026-80223 is an incorrect authorization vulnerability in ash-project's ash_graphql component. It allows an authenticated subscriber in one tenant to receive records belonging to another tenant via GraphQL subscriptions. The flaw arises because tenant scoping is applied during query building and data-layer prefixing, but not during in-memory policy evaluation of subscription notifications. This leads to cross-tenant data leakage when subscription notifications are authorized in memory without tenant checks. The issue affects versions from 1.4.0 up to but not including 1.11.0.