CVE-2026-77850
HighCVSS 8.4Summary
A Stored Cross-site Scripting vulnerability in ash_admin executes attacker-supplied record content as script in an administrator's browser. The RelationshipField and ManagedRelationshipSelectField components render labels without proper escaping.
Risk Assessment
An attacker can hijack an administrator's session and gain full privileges in the admin panel, potentially leading to data theft or system modification.
Recommendation
It is recommended to upgrade ash_admin to version 1.3.1 or later, which includes a fix that escapes labels before inserting highlight markup.
Other vulnerabilities in ash_admin
See all- CVE-2026-82722High
A vulnerability in ash_admin allows any client that can reach the admin LiveView to exhaust the BEAM atom table and crash the entire node. Two LiveView event handlers intern atoms from unvalidated client input, and atoms are never garbage collected, leading to a crash.
- CVE-2026-82681Low
A vulnerability in ash_admin allows an attacker who controls a record's string primary key to rewrite the target of AshAdmin's row-action links. Links are built via raw string interpolation without URL-encoding, enabling parameter injection and redirecting admins to unintended actions.
- CVE-2026-82673High
A Path Traversal vulnerability in ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server. The browser-supplied filename is not sanitized, allowing writes outside the temporary directory.
- CVE-2026-81853Low
A vulnerability in ash_admin allows authorization bypass through user-controlled keys, turning a record-lookup URL into an equality oracle over sensitive attributes. The primary key decoding does not verify that returned fields are actual primary key fields, enabling brute-force of sensitive values.
- CVE-2026-81852Low
A vulnerability in ash_admin involves the use of a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. The default nonce is a constant known from the repository and is not rotated, allowing its reuse to run unauthorized scripts.
- CVE-2026-75757High
A vulnerability in ash_admin relying on cookies without validation and integrity checking allows an attacker controlling a sibling subdomain to rebind an admin's session to a different actor, tenant, or authorization mode. Cookies are matched using an unanchored regular expression.
Original NVD description (English source)
Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser. The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in <b> tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record's label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as <img src=x onerror=...> runs as JavaScript in the admin's session as soon as a matching record appears in the dropdown, giving the attacker the admin's privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup. This issue affects ash_admin: from 0.13.0 before 1.3.1.