CVE-2026-77850 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content

Stored Cross-site Scripting vulnerability in ash-project ashadmin executes attacker-supplied record content as script in an administrator's browser. The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField...

CVE-2026-77850

Stored XSS in ash-project's ash_admin (versions 0.13.0 before 1.3.1 ) allows lower-privileged users to execute arbitrary JavaScript in an administrator's browser. The root cause lies in the relationship typeahead components RelationshipField and ManagedRelationshipSelectField , which highlight ma...