ash_ai vulnerabilities

In ash_ai (from 0.6.0 before 1.0.0), a vulnerability allows disclosure of sensitive information in error messages. Exceptions during tool execution are sent to chat users without filtering, potentially revealing internal technical details.

In ash_ai (from 0.6.0 before 1.0.0), a vulnerability allows an infinite loop. An attacker who can influence model outputs can hang the tool loop and cause unbounded, repeated model requests.

An authorization bypass through user-controlled key vulnerability in ash_ai allows a caller to update or destroy records it never identified, including every row in the table. The identity filter is built directly from raw tool arguments.

A vulnerability in ash_ai discloses provider request state and credentials in a user-facing validation error. When the embedding provider call fails, the error contains the raw error term, which may include the URL, response body, and Authorization header with the API key.

An Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. With default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https, both attacker-controlled. The issue affects ash_ai from 0.8.0 before 1.0.0.

A code injection vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2, and when prompt content incorporates request data, attacker-controlled text is compiled and run as an EEx template. This affects ash_ai from 0.1.0 before 1.0.0.