Skip to content
OpenAdvisories

Package · Hex

ash

31 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.6
    CVE-2026-96581

    An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records

    Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create (lib/ash/a…

    ash-project ash ash Hex
  • High 8.2
    CVE-2026-94201

    Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash

    Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.Type.Atom. Because the type defined no coerce/2 callback, coercion fell back to the defaul…

    ash-project ash ash Hex
  • High 7.5
    CVE-2026-67579

    Filter expression injection via forged keyset pagination cursor in Ash

    Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actio…

    ash-project ash ash Hex
  • High 8.2
    CVE-2026-34593

    Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash

    Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type.Module.cast_input/2 unconditionally creates a new Erlang atom via Module.concat([value]) for any user-supplied binary string that starts w…

    ash-project ash ash Hex
  • High 8.6
    CVE-2025-48044

    Authorization bypass when bypass policy condition evaluates to true

    Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This issue affects ash: from 3.6.3 before 3.7.1.

    ash-project ash ash Hex
  • High 8.6
    CVE-2025-48043

    Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization

    Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This issue affects ash: from 0.1.1 before 3.6.2.

    ash-project ash ash Hex
  • High 7.1
    CVE-2025-48042

    Before action hooks may execute in certain scenarios despite a request being forbidden

    Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ash: from 0.1.1 before 3.5.39.

    ash-project ash ash Hex