CVE-2026-82580
MediumCVSS 5.3Summary
In ash_ai (from 0.6.0 before 1.0.0), a vulnerability allows disclosure of sensitive information in error messages. Exceptions during tool execution are sent to chat users without filtering, potentially revealing internal technical details.
Risk Assessment
Chat users may access internal error messages, potentially exposing infrastructure details or sensitive data, facilitating further attacks.
Recommendation
Upgrade ash_ai to version 1.0.0 or later, which includes the fix.
Other vulnerabilities in ash_ai
See all- CVE-2026-82579Medium
In ash_ai (from 0.6.0 before 1.0.0), a vulnerability allows an infinite loop. An attacker who can influence model outputs can hang the tool loop and cause unbounded, repeated model requests.
- CVE-2026-82564High
An authorization bypass through user-controlled key vulnerability in ash_ai allows a caller to update or destroy records it never identified, including every row in the table. The identity filter is built directly from raw tool arguments.
- CVE-2026-75760High
A vulnerability in ash_ai discloses provider request state and credentials in a user-facing validation error. When the embedding provider call fails, the error contains the raw error term, which may include the URL, response body, and Authorization header with the API key.
- CVE-2026-81315High
An Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. With default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https, both attacker-controlled. The issue affects ash_ai from 0.8.0 before 1.0.0.
- CVE-2026-77956Critical
A code injection vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2, and when prompt content incorporates request data, attacker-controlled text is compiled and run as an EEx template. This affects ash_ai from 0.1.0 before 1.0.0.
Original NVD description (English source)
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content. That content is appended to the conversation, emitted as a {:tool_result, ...} stream event, and sent back to the model, which typically relays it to the user. No filtering happened first, so anything raised inside a tool callback or lifecycle hook (database constraint messages, adapter errors, query fragments, policy or validation internals) was echoed as-is. A chat user who can steer tool arguments into a raising code path receives the raw internal text. The fix routes raised tool errors through the same safe formatter used for other tool errors. This issue affects ash_ai: from 0.6.0 before 1.0.0.