Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105283— Internal error terms inspected into AshTypescript RPC error responses

Quick assessment

Affected
ash-project ash_typescript
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ash-typescript 中存在生成包含敏感信息的错误消息漏洞，允许未经身份验证的攻击者通过触发错误构建器没有专门处理子句的错误，从而从 RPC 错误响应中读取内部 Elixir 术语。 AshTypescript.Rpc.ErrorBuilder.build_error_response/1（位于 lib/ash_typescript/rpc/error_builder.ex 中）使用 inspect/1 渲染一个不匹配任何特定子句的 pipeline 错误术语，并将结果放入面向客户端的错误中的 detail

CVSS 6.3 · Medium

Affected Version Matrix 2

VendorProduct Version RangeStatus
ash-project ash_typescript 0.1.0< 0.19.1 affected
8e204ce34e24a158cf22a2dac4d53c44716c9e30< 4b3c65203ee78dc992d6d2e6559625c5460a01cd affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105283

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Internal error terms inspected into AshTypescript RPC error responses
Source: CVE Program / CVE List V5
Vulnerability Description
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for. AshTypescript.Rpc.ErrorBuilder.build_error_response/1 in lib/ash_typescript/rpc/error_builder.ex renders a pipeline error term that matches no specific clause with inspect/1 and places the result in details.error of the client-facing error. Ash exceptions take a separate path in AshTypescript.Rpc.Errors where unhandled cases are redacted behind an errorId, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where cast_map_to_struct/2 in lib/ash_typescript/rpc/input_formatter.ex throws the raw Ash.Type cast error into the builder, and field selection on a generic action that returns a primitive, where format_field_type/1 inspects the full Ash.Info.Manifest.Type struct into vars.returnType. Resource module names in vars.resource are not treated as sensitive and are out of scope. This issue affects ash_typescript: from 0.1.0 before 0.19.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过错误消息导致的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ash-project ash_typescript 0.1.0 ~ 0.19.1 cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*
ash-project ash_typescript 8e204ce34e24a158cf22a2dac4d53c44716c9e30 ~ 4b3c65203ee78dc992d6d2e6559625c5460a01cd cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-105283

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105283

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-105283 (1)

Vendor Advisories for CVE-2026-105283 (2)

Other References for CVE-2026-105283 (1)

IV. Related Vulnerabilities

Same product: ash_typescript
Same vendor: ash-project
Same weakness: CWE-209

V. Comments for CVE-2026-105283

No comments yet

Leave a comment