Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-77950— RPC error handler fails open in AshTypescript, disclosing unredacted errors

Quick assessment

Affected
ash-project ash_typescript
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

漏洞描述翻译： ash-project 的 ash_typescript 中存在“生成包含敏感信息的错误消息”漏洞，使得未认证的攻击者能够通过触发一种已配置的错误处理器未能匹配的错误形态，从而接收到未经脱敏的内部错误数据。 在 中的 是应用端在错误到达客户端前进行脱敏或抑制错误的唯一钩子，返回 会完全丢弃该错误。其 子句仅记录一条警告日志，然后返回原始的错误映射（即处理器执行前的错误）。由于错误处理器通常被编写为针对预期错误形态的模式匹配函数，当遇到未匹配的错误形态时，会抛出 ，从而将原始的错误对象（包括 中携带的

CVSS 6.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77950

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RPC error handler fails open in AshTypescript, disclosing unredacted errors
Source: CVE Program / CVE List V5
Vulnerability Description
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. apply_error_handler/3 in lib/ash_typescript/rpc/errors.ex is the only hook an application has for redacting or suppressing errors before they reach the client, with a nil return dropping the error entirely. Its rescue clause logs a warning and then returns the original, pre-handler error map. Error handlers are conventionally written as pattern-matching functions over expected error shapes, so an unmatched shape raises FunctionClauseError and the raw transformed error, including any secrets carried in vars, is emitted instead. An intent to suppress an error becomes an intent to publish it. The rescue catches exceptions only, so a handler that throws or exits still propagates. This issue affects ash_typescript: from 0.8.0 before 0.18.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过错误消息导致的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ash-project ash_typescript 0.8.0 ~ 0.18.0 cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*
ash-project ash_typescript cb01cc8749e5a2a17fb45aedbe75df30a9f1126e ~ 59d8e985a98cf2e01794dbe5b919b897a95311f4 cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-77950

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77950

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-77950 (1)

Vendor Advisories for CVE-2026-77950 (1)

Other References for CVE-2026-77950 (2)

Same Patch Batch · ash-project · 2026-09-01 · 23 CVEs total

CVE-2026-74837 8.7 HIGH Unbounded atom creation from client-supplied RPC field names in AshTypescript field format
CVE-2026-77856 8.2 HIGH Unbounded atom creation from typed struct field names in AshTypescript field selector
CVE-2026-82730 8.2 HIGH Authorization-redacted field values disclosed through AshTypescript result normalization
CVE-2026-82732 6.3 MEDIUM Declared argument constraints not enforced on AshTypescript typed controller routes
CVE-2026-82733 6.3 MEDIUM Route handler return value echoed into AshTypescript error response
CVE-2026-82738 5.9 MEDIUM Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of
CVE-2026-82735 5.9 MEDIUM Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service
CVE-2026-82737 5.9 MEDIUM Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting
CVE-2026-82747 5.9 MEDIUM Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
CVE-2026-82742 5.9 MEDIUM Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships,
CVE-2026-82745 5.9 MEDIUM ETS and Mnesia data layers overwrite an existing record on create instead of enforcing pri
CVE-2026-82746 5.9 MEDIUM Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to for
CVE-2026-82749 5.9 MEDIUM Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is
CVE-2026-82731 2.3 LOW Unescaped path parameters in AshTypescript generated TypeScript client allow request redir
CVE-2026-82740 2.1 LOW Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs
CVE-2026-82739 2.1 LOW Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic misma
CVE-2026-82741 2.1 LOW Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion
CVE-2026-82736 2.1 LOW Ash.Type.CiString validates length and match constraints before case folding, allowing con
CVE-2026-82743 2.1 LOW Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads
CVE-2026-82734 2.1 LOW Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal

Showing top 20 of 23 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: ash_typescript
Same vendor: ash-project
Same weakness: CWE-209

V. Comments for CVE-2026-77950

No comments yet

Leave a comment