EEF-CVE-2026-82734 Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal

Summary Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numeric bounds constraints or fails later operations on the value. Ash.Type.Decimal cast input through Ecto's decimal cast in castinput...

CVE-2026-77950 RPC error handler fails open in AshTypescript, disclosing unredacted errors

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

SUSE CVE-2026-75758

Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.tostring/1, or List.tocharlist/1 to exhaust a BEAM node's memory. Inspect.List's charlist branch in lib/elixir/lib/inspect.ex classifies a list as a charlist using...

CVE-2026-82733: Generation of Error Message Containing Sensitive Information

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route handler returns anything other than a %Plug.Conn, dispatch/3 i...

PT-2026-84093

Not Failing Securely Failing Open vulnerability in ash-project ash skips an Ash.Reactor change when the guard controlling it raises, so a change meant to run does not. An Ash.Reactor change step can be gated by where validations that decide whether the change runs. Ash.Reactor.ChangeStep...

CVE-2026-82736: Incorrect Behavior Order: Validate Before Canonicalize

Incorrect Behavior Order: Validate Before Canonicalize vulnerability in ash-project ash lets an attacker store a case-insensitive string value that violates its length or match constraints. Ash.Type.CiString.applyconstraints/2 lib/ash/type/cistring.ex validated the maxlength, minlength, and match...

CVE-2026-82749: Incorrect Authorization

Incorrect Authorization vulnerability in ash-project ash widens a relationship's parent... scoping filter to match unintended records when the referenced parent field cannot be resolved. Loading a relationship whose filter references parent... resolves that expression against the parent record...

CVE-2026-77956

Improper Control of Generation of Code Code Injection vulnerability in ash-project ashai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.evalstring/2. The documented prompt: fn input, context - ... end form lets t...

Linux Distros Unpatched Vulnerability : CVE-2026-75758

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.tostring/1, or...

CVE-2026-77956: Improper Control of Generation of Code

Improper Control of Generation of Code Code Injection vulnerability in ash-project ashai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.evalstring/2. The documented prompt: fn input, context - ... end form lets t...

PT-2026-83643

Name of the Vulnerable Software and Affected Versions ash ai versions 0.1.0 through 0.9.x Description An improper control of code generation allows a remote, unauthenticated client to execute arbitrary Elixir code. The AshAi.Actions.Prompt function evaluates prompt content using EEx.eval string/2...

CVE-2026-80227

Incorrect Comparison vulnerability in ash-project ashsql allows a user to pad a string field with tab, newline, carriage-return, or form-feed characters and pass a trimmed uniqueness or equality check in the database that the same expression would fail in memory or the reverse. stringtrim/1...

EUVD-2026-68187

Incorrect Comparison vulnerability in ash-project ashsql allows a user to pad a string field with tab, newline, carriage-return, or form-feed characters and pass a trimmed uniqueness or equality check in the database that the same expression would fail in memory or the reverse. stringtrim/1...

CVE-2026-80227 SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql

Incorrect Comparison vulnerability in ash-project ashsql allows a user to pad a string field with tab, newline, carriage-return, or form-feed characters and pass a trimmed uniqueness or equality check in the database that the same expression would fail in memory or the reverse. stringtrim/1...

CVE-2026-80227: Incorrect Comparison

Incorrect Comparison vulnerability in ash-project ashsql allows a user to pad a string field with tab, newline, carriage-return, or form-feed characters and pass a trimmed uniqueness or equality check in the database that the same expression would fail in memory or the reverse. stringtrim/1...

CVE-2026-77454: Incorrect Authorization

Incorrect Authorization vulnerability in ash-project ashsql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relationship that declares both a limit or frommany? and a parent...-referencing filter or sort. AshSql.Join.relatedquery/3 skips the caller-supplie...

FreeBSD : Elixir -- Denial of service via uncontrolled recursion in charlist conversion (2ab3c852-d10a-4d68-be6b-80619116c33a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 2ab3c852-d10a-4d68-be6b-80619116c33a advisory. tomciopp reports: Uncontrolled recursion in the Elixir standard library lets an attacker who controls a...

FreeBSD : Elixir -- Denial of service via uncontrolled recursion in charlist conversion (aac25935-f19d-4ac8-80fc-043365686a63)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the aac25935-f19d-4ac8-80fc-043365686a63 advisory. tomciopp reports: Uncontrolled recursion in the Elixir standard library lets an attacker who controls a...

CVE-2026-75758

Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.tostring/1, or List.tocharlist/1 to exhaust a BEAM node's memory. Inspect.List's charlist branch in lib/elixir/lib/inspect.ex classifies a list as a charlist using...

AZL-98220 CVE-2026-75758 affecting package elixir for versions less than 1.16.1-3

Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.tostring/1, or List.tocharlist/1 to exhaust a BEAM node's memory. Inspect.List's charlist branch in lib/elixir/lib/inspect.ex classifies a list as a charlist using...