CVE-2026-82681

ash-project ash_admin (Elixir admin panel) contains a query-parameter injection in the Table, DataTable, and Show components. Row-action URLs were built via raw string interpolation of the primary key without URL-encoding. Because the primary key is spliced last into the query string and Plug.Con...

CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...