Skip to content
OpenAdvisories

Package · Hex

ash_lua

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.2
    CVE-2026-82586

    AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

    Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fiel…

    ash-project ash_lua ash_lua Hex