ash-project ash vulnerabilities

CVEs per yearBy the year they were published

1. 20253
2. 202628

Newest CVEs

• CVE-2026-96581

  An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records

  ash-project · ash

  High7.6
• CVE-2026-114214

  Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records

  ash-project · ash

  Medium6.0
• CVE-2026-101028

  Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts

  ash-project · ash

  Medium6.0
• CVE-2026-94201

  Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash

  ash-project · ash

  High8.2
• CVE-2026-93477

  Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

  ash-project · ash

  Medium5.9
• CVE-2026-86338

  Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle

  ash-project · ash

  Medium6.0
• CVE-2026-82752

  Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length

  ash-project · ash

  Medium5.9
• CVE-2026-82747

  Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor

  ash-project · ash

  Medium5.9
• CVE-2026-82749

  Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records

  ash-project · ash

  Medium5.9
• CVE-2026-82748

  Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another

  ash-project · ash

  Low2.1