CVE-2026-105283

Generation of error message containing sensitive information vulnerability in ash_typescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a route handler returns a non-%Plug.Conn{} value, the unexpected_return/2 function interpolates the full inspect of the value (including passwords, tokens, tenant identifiers) into the error message.

Improper input validation vulnerability in ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. The Ash.Type.cast_input/3 function is treated as fully validated, but it does not call Ash.Type.apply_constraints/3, so constraints such as one_of, max_length, min, max, and match are ignored.

Vulnerability in the ash_typescript library allows an attacker who controls a path-parameter value to redirect a generated client's request, along with attached credentials, to an unintended route or external origin.

An incorrect authorization vulnerability in ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField{}, which retains the real value in original_value, and AshTypescript.Rpc.ResultProcessor fails to handle this marker in normalize_primitive/1, leading to serialization of the original value. This issue affects versions from 0.11.0 before 0.18.0.

Generation of error message containing sensitive information vulnerability in ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. The apply_error_handler/3 function, when the pattern does not match, raises FunctionClauseError and returns the original error map, including sensitive data.

An allocation of resources without limits vulnerability in ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. The resolve_typed_struct_field/2 function uses String.to_atom/1 for unresolvable names, creating permanent atoms that are never garbage collected, leading to exceeding the limit and crash. This issue affects versions from 0.11.0 before 0.18.0.

An allocation of resources without limits vulnerability in ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. The convert_to_field_atom/2 function uses String.to_atom/1 for unresolvable names, creating permanent atoms that are never garbage collected, leading to exceeding the limit and crash. Additionally, field names longer than 255 characters cause an uncaught SystemLimitError. This issue affects versions from 0.1.0 before 0.18.0.