Skip to content
OpenAdvisories

Package · Hex

ash_lua

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.0
    CVE-2026-78216

    AshLua eval read operations can read field-policy-protected fields via aggregates

    AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact for…

    ash-project ash_lua ash_lua Hex
  • High 8.2
    CVE-2026-82586

    AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

    Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fiel…

    ash-project ash_lua ash_lua Hex