CVE-2026-82731
LowCVSS 2.3Summary
Vulnerability in the ash_typescript library allows an attacker who controls a path-parameter value to redirect a generated client's request, along with attached credentials, to an unintended route or external origin.
Risk Assessment
An attacker can exploit the open redirect to capture credentials or redirect traffic to a malicious server, potentially leading to data theft or security compromise.
Recommendation
Update the ash_typescript library to version 0.18.0 or later, which encodes path parameter values before inserting into URLs.
Other vulnerabilities in ash_typescript
See all- CVE-2026-82733Medium
Generation of error message containing sensitive information vulnerability in ash_typescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a route handler returns a non-%Plug.Conn{} value, the unexpected_return/2 function interpolates the full inspect of the value (including passwords, tokens, tenant identifiers) into the error message.
- CVE-2026-82732Medium
Improper input validation vulnerability in ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. The Ash.Type.cast_input/3 function is treated as fully validated, but it does not call Ash.Type.apply_constraints/3, so constraints such as one_of, max_length, min, max, and match are ignored.
- CVE-2026-82730High
An incorrect authorization vulnerability in ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField{}, which retains the real value in original_value, and AshTypescript.Rpc.ResultProcessor fails to handle this marker in normalize_primitive/1, leading to serialization of the original value. This issue affects versions from 0.11.0 before 0.18.0.
- CVE-2026-77950Medium
Generation of error message containing sensitive information vulnerability in ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. The apply_error_handler/3 function, when the pattern does not match, raises FunctionClauseError and returns the original error map, including sensitive data.
- CVE-2026-77856High
An allocation of resources without limits vulnerability in ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. The resolve_typed_struct_field/2 function uses String.to_atom/1 for unresolvable names, creating permanent atoms that are never garbage collected, leading to exceeding the limit and crash. This issue affects versions from 0.11.0 before 0.18.0.
- CVE-2026-74837High
An allocation of resources without limits vulnerability in ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. The convert_to_field_atom/2 function uses String.to_atom/1 for unresolvable names, creating permanent atoms that are never garbage collected, leading to exceeding the limit and crash. Additionally, field names longer than 255 characters cause an uncaught SystemLimitError. This issue affects versions from 0.1.0 before 0.18.0.
Original NVD description (English source)
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redirect a generated client's request, and the credentials attached to it, to an unintended route or an external origin. The URL builders in lib/ash_typescript/typed_controller/codegen/route_renderer.ex replace each :param placeholder with a bare template interpolation and never call encodeURIComponent, so the value reaches executeTypedControllerRequest raw. A value containing ../ is normalised away by the fetch URL resolver and reaches a different route, while ? or # truncates the path and can smuggle or override query parameters. For a route whose path begins with a parameter, a value such as /evil.example.com/x yields the protocol-relative URL //evil.example.com/x, sending the request and the credentials from TypedControllerConfig to an attacker-controlled host. Nothing constrains the value at runtime: get_path_param_type/2 emits only a TypeScript type, which is erased. The query-string path is unaffected, since URLSearchParams.set encodes its own values. This issue affects ash_typescript: from 0.15.0 before 0.18.0.