Threat Intelligence Database

AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool's existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization. The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible. This issue affects ash_ai: from 0.1.0 before 1.0.3.

CVE-2026-75760 is a vulnerability in ash-project's ash_ai component that causes error messages to leak sensitive information. When the embedding provider call fails in AshAi.Changes.Vectorize, the error message includes unsanitized details such as the request URL, provider response body, and potentially the Authorization header containing the API key. This information is exposed to users via validation errors. The issue affects versions from 0.1.0 up to but not including 1.0.0. The vulnerability has a high severity score of 7.1.

CVE-2026-82580 is a vulnerability in ash-project ash_ai where internal error messages containing sensitive information are disclosed to chat users. This occurs because exceptions raised during tool execution are serialized and sent back to the user without filtering. The issue affects versions from 0.6.0 up to but not including 1.0.0. The vulnerability has a medium severity score of 5.3. No official patch or remediation guidance is currently available.

CVE-2026-82579 is an infinite loop vulnerability in the ash_ai tool of the ash-project. The vulnerability occurs when the tool loop processes model responses that result in an empty list after filtering, causing the loop to recurse indefinitely without advancing the conversation. This can lead to unbounded repeated model requests, potentially hanging the tool. The issue affects versions from 0.6.0 up to but not including 1.0.0.

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identity_filter/3 built the update/destroy filter directly from the raw tool arguments as [{key, Map.get(arguments, to_string(key))}] and passed it to Ash.Query.do_filter/2. A map value is parsed as a predicate expression rather than a literal, so a caller can send {"public_ref": {"not_eq": "<own-ref>"}} and, combined with Ash.Query.limit(1) and Ash.bulk_update!/Ash.bulk_destroy!, retarget the write at a record it never identified; an omitted key yields an IS NULL filter that matches an arbitrary row. The fix casts each identity value to the field type, rejecting non-scalar inputs. This issue affects ash_ai: from 0.6.0 before 1.0.0.

CVE-2026-81315 is an origin validation error vulnerability in ash-project's ash_ai server component that allows a malicious web page to bypass DNS-rebinding protections. The vulnerability arises because the server trusts the Host header and X-Forwarded-Proto header without proper validation, enabling an attacker to issue cross-site requests to a user's local MCP server with that user's privileges. This affects ash_ai versions from 0.8.0 up to but not including 1.0.0. The default configuration is insecure, but the fix involves restricting trusted origins to localhost and requiring an explicit allowlist for others.

CVE-2026-77956 is a high-severity code injection vulnerability in ash-project's ash_ai component. It allows a remote, unauthenticated attacker to execute arbitrary Elixir code by exploiting the evaluation of prompt content as EEx templates. The vulnerability affects versions from 0.1.0 up to but not including 1.0.0. The issue arises because attacker-controlled input can be compiled and executed on the server without authentication. The fix involves stopping the evaluation of function-supplied prompt content as EEx templates, limiting evaluation to statically configured templates only.