CVE-2026-82733
MediumCVSS 6.3Summary
Generation of error message containing sensitive information vulnerability in ash_typescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a route handler returns a non-%Plug.Conn{} value, the unexpected_return/2 function interpolates the full inspect of the value (including passwords, tokens, tenant identifiers) into the error message.
Risk Assessment
An attacker can access sensitive data such as passwords, tokens, and tenant identifiers, potentially leading to data breach.
Recommendation
Upgrade ash_typescript to version 0.18.0 or later to remediate the vulnerability.
Other vulnerabilities in ash_typescript
See all- CVE-2026-82732Medium
Improper input validation vulnerability in ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. The Ash.Type.cast_input/3 function is treated as fully validated, but it does not call Ash.Type.apply_constraints/3, so constraints such as one_of, max_length, min, max, and match are ignored.
- CVE-2026-82731Low
Vulnerability in the ash_typescript library allows an attacker who controls a path-parameter value to redirect a generated client's request, along with attached credentials, to an unintended route or external origin.
- CVE-2026-82730High
An incorrect authorization vulnerability in ash_typescript allows an unauthorized RPC caller to read attribute values that Ash field policies denied. When a field policy denies an attribute, Ash substitutes %Ash.ForbiddenField{}, which retains the real value in original_value, and AshTypescript.Rpc.ResultProcessor fails to handle this marker in normalize_primitive/1, leading to serialization of the original value. This issue affects versions from 0.11.0 before 0.18.0.
- CVE-2026-77950Medium
Generation of error message containing sensitive information vulnerability in ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. The apply_error_handler/3 function, when the pattern does not match, raises FunctionClauseError and returns the original error map, including sensitive data.
- CVE-2026-77856High
An allocation of resources without limits vulnerability in ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied typed struct field names. The resolve_typed_struct_field/2 function uses String.to_atom/1 for unresolvable names, creating permanent atoms that are never garbage collected, leading to exceeding the limit and crash. This issue affects versions from 0.11.0 before 0.18.0.
- CVE-2026-74837High
An allocation of resources without limits vulnerability in ash_typescript allows an unauthenticated attacker to exhaust the BEAM atom table and abort the node via client-supplied RPC field names. The convert_to_field_atom/2 function uses String.to_atom/1 for unresolvable names, creating permanent atoms that are never garbage collected, leading to exceeding the limit and crash. Additionally, field names longer than 255 characters cause an uncaught SystemLimitError. This issue affects versions from 0.1.0 before 0.18.0.
Original NVD description (English source)
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route handler returns anything other than a %Plug.Conn{}, dispatch/3 in lib/ash_typescript/typed_controller/request_handler.ex passes the value to unexpected_return/2, which interpolates inspect(value, limit: 50) directly into the response message. The limit option bounds elements per collection rather than the term as a whole, so a handler falling through with a term such as {:error, %User{}} or a changeset serialises its full field set, including hashed passwords, tokens, and tenant identifiers, into the JSON error returned to the caller. This contradicts the module's own posture elsewhere: the rescue clause gates Exception.message/1 behind AshTypescript.typed_controller_show_raised_errors?/0 and otherwise returns a generic message, while this path is ungated and always echoes. This issue affects ash_typescript: from 0.15.0 before 0.18.0.