CVE-2026-94201

The ash: library (versions 3.5.1 before 3.34.3) is vulnerable to a denial of service (DoS) attack due to how it handles :atom-typed attributes. When an attribute is configured with unsafe_to_atom?: true, filtering that attribute with attacker-controlled strings causes the system to intern new, pe...

EUVD-2026-92768

Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison value is coerced through Ash.Type.Atom. Because the type defined no coerce/2 callback, coercion fell back to the default castinput/2, which calls...

CVE-2026-93477

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

CVE-2026-93477 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

EUVD-2026-86550

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

CVE-2026-93477 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

CVE-2026-93477 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument on the bulk destroy and bulk update paths. Action arguments declared with public?: false are meant to be set only by trusted...

CVE-2026-93477

The ash-project ash framework is vulnerable to an Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability. In versions 2.17.15 before 3.33.11 , the Ash.Actions.Destroy.Bulk.base_changeset/5 and Ash.Actions.Update.Bulk.base_changeset/5 functions fail to verify ...

EUVD-2026-38570

Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets...

Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets

Summary Ash fails to consistently strip private action arguments those declared with public?: false when a changeset is built from an untrusted parameter map. Private arguments are meant to be set only by trusted server-side code, but a caller who controls the parameters supplied to an action can...

CVE-2026-86338

Ash fieldpolicies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see. This...

EUVD-2026-80285

Ash fieldpolicies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see. This...

EEF-CVE-2026-86338 Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle

Summary Ash fieldpolicies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot se...

CVE-2026-86338

Ash (Elixir) field_policies were intended to prevent filter-based information disclosure by nilling forbidden field references in filters. The nilling mechanism matched only Ash.Resource.* structs (attributes) but failed to match Ash.Query.Calculation and Ash.Query.Aggregate structs, so filters r...

CVE-2026-86338 Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle

Ash fieldpolicies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see. This...

CVE-2026-86338 Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle

Ash fieldpolicies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see. This...

CVE-2026-86338 Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle

Ash fieldpolicies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see. This...

CVE-2026-86338: Insufficient Granularity of Access Control

Ash fieldpolicies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced in a filter, it is replaced with an expression that evaluates to nil, so a filter cannot be used as a yes/no oracle to read a value the actor cannot see. This...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: busybox (UTSA-2023-002393)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002393 advisory. There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from...

EUVD-2026-72589

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usagerules allows a malicious package publisher to inject terminal control sequences into the output of mix usagerules.searchdocs. mix usagerules.searchdocs searches Hex documentation through...