CVE-2026-80227— SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql
Quick assessment
Affected
ash-project ash_sql
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述的中文翻译： ash-project 中 ash_sql 存在一个不正确的比较（Incorrect Comparison）漏洞。攻击者可以通过在字符串字段中填充制表符（tab）、换行符（newline）、回车符（carriage return）或换页符（form feed）字符，从而绕过数据库中经过修剪的“唯一性”或“相等性”检查，而这些输入在内存中的相同表达式中可能会失败（或者情况相反）。 编译为基于 Elixir 字符串构建的 模式，其中 是单个空格（码点 32）的转义字符，而不是正则表达式中的
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-80227
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql
Source: CVE Program / CVE List V5
Vulnerability Description
Incorrect Comparison vulnerability in ash-project ash_sql allows a user to pad a string field with tab, newline, carriage-return, or form-feed characters and pass a trimmed uniqueness or equality check in the database that the same expression would fail in memory (or the reverse).
string_trim/1 compiles to REGEXP_REPLACE patterns built from an Elixir string in which \s is the escape for a single space (codepoint 32), not a regex whitespace class. The generated SQL therefore removes only literal spaces and leaves tabs, newlines, carriage returns, and form feeds in place, whereas String.trim/1 in Elixir removes them all. Any Ash filter, validation, or identity that relies on string_trim/1 then behaves differently depending on whether Ash pushes the expression down to SQL or evaluates it in memory, so padded input can register a near-duplicate value or slip past a trimmed comparison.
This issue affects ash_sql: from 0.1.0 before 0.7.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的比较
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ash-project | ash_sql | 0.1.0 ~ 0.7.1 |
cpe:2.3:a:ash-project:ash_sql:*:*:*:*:*:*:*:*
|
|
| ash-project | ash_sql | dd092ed273dec7bd2194352f24a39229fc8ae68b ~ 1b11b5d8bc5321e2e6acac21594ef08f61986117 |
cpe:2.3:a:ash-project:ash_sql:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-80227
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-80227
请登录查看更多情报信息。
Other References for CVE-2026-80227 (4)
-
https://github.com/ash-project/ash_sql/security/advisories/GHSA-76wx-w7ww-5xfq vendor-advisory related
Same Patch Batch · ash-project · 2026-08-30 · 11 CVEs total
| CVE-2026-75847 | 5.9 MEDIUM | Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail |
| CVE-2026-77970 | 5.9 MEDIUM | Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions |
| CVE-2026-78038 | 5.9 MEDIUM | Job argument injection via :args overrides primary_key and tenant in AshOban |
| CVE-2026-78228 | 5.9 MEDIUM | Unbounded handle_error recursion enables denial of service in AshOban triggers |
| CVE-2026-77454 | 5.9 MEDIUM | exists/2 predicate silently dropped on limited relationships with a parent() filter in Ash |
| CVE-2026-77831 | 2.1 LOW | Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking |
| CVE-2026-77846 | 2.1 LOW | JSON path injection via unescaped get_path segments in AshSqlite |
| CVE-2026-81318 | 2.1 LOW | Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql |
| CVE-2026-78691 | 2.1 LOW | Unescaped backslash allows LIKE wildcard injection in AshSql string search |
| CVE-2026-81316 | 2.1 LOW | Same-named aggregates with differing filters are conflated in AshSql |
IV. Related Vulnerabilities
Same product: ash_sql
-
CVE-2026-77454
exists/2 predicate silently dropped on limited relationships -
CVE-2026-81316
Same-named aggregates with differing filters are conflated i -
CVE-2026-81318
Distinct-query aggregate drops the tenant schema prefix, lea -
CVE-2026-78691
Unescaped backslash allows LIKE wildcard injection in AshSql
Same vendor: ash-project
-
CVE-2026-77454
exists/2 predicate silently dropped on limited relationships -
CVE-2026-81316
Same-named aggregates with differing filters are conflated i -
CVE-2026-81318
Distinct-query aggregate drops the tenant schema prefix, lea -
CVE-2026-78691
Unescaped backslash allows LIKE wildcard injection in AshSql -
CVE-2026-78228
Unbounded handle_error recursion enables denial of service i
Same weakness: CWE-697
-
CVE-2026-73258
Mongoose: Multipart boundary/header scan logic error in mg_h -
CVE-2026-75110
MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRE -
CVE-2026-50029
js-toml has silent type confusion via falsy-primitive duplic -
CVE-2026-67207
Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreContr -
CVE-2026-48032
Hulumi: IAM-role policy checks bypassed when the role trusts
V. Comments for CVE-2026-80227
No comments yet