ash-project vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20253
3. 202687

Newest CVEs

• CVE-2026-96581

  An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records

  ash-project · ash

  High7.6
• CVE-2026-115627

  AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows

  ash-project · ash_postgres

  Medium6.0
• CVE-2026-115635

  AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set

  ash-project · ash_postgres

  Medium6.0
• CVE-2026-114214

  Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records

  ash-project · ash

  Medium6.0
• CVE-2026-105283

  Internal error terms inspected into AshTypescript RPC error responses

  ash-project · ash_typescript

  Medium6.3
• CVE-2026-101028

  Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts

  ash-project · ash

  Medium6.0
• CVE-2026-94201

  Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash

  ash-project · ash

  High8.2
• CVE-2026-93477

  Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

  ash-project · ash

  Medium5.9
• CVE-2026-86338

  Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle

  ash-project · ash

  Medium6.0
• CVE-2026-78216

  AshLua eval read operations can read field-policy-protected fields via aggregates

  ash-project · ash_lua

  Medium6.0