CVE-2026-82580— AshAi echoes raw tool exception messages into the conversation, disclosing internal details
Quick assessment
Affected
ash-project ash_ai
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ash-project 中的 ash_ai 存在“包含敏感信息的错误消息生成”漏洞，会将内部错误文本暴露给聊天用户。 在 AshAi.ToolLoop 和 AshAi.Tools 中，工具执行过程中抛出的异常会通过 Exception.message/1 被原样序列化，并作为工具返回内容（tool-result content）。该内容会被追加到对话中，以 {:tool_result, ...} 流事件的形式发出，并返回给模型，模型通常会将此信息转述给用户。由于此前未进行任何过滤，工具回调或生命周期钩子中抛出的任何
Possible ATT&CK Techniques 1 AI
T1070 · Indicator Removal
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82580
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AshAi echoes raw tool exception messages into the conversation, disclosing internal details
Source: CVE Program / CVE List V5
Vulnerability Description
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat users.
In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content. That content is appended to the conversation, emitted as a {:tool_result, ...} stream event, and sent back to the model, which typically relays it to the user. No filtering happened first, so anything raised inside a tool callback or lifecycle hook (database constraint messages, adapter errors, query fragments, policy or validation internals) was echoed as-is. A chat user who can steer tool arguments into a raising code path receives the raw internal text. The fix routes raised tool errors through the same safe formatter used for other tool errors.
This issue affects ash_ai: from 0.6.0 before 1.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过错误消息导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ash-project | ash_ai | 0.6.0 ~ 1.0.0 |
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*
|
|
| ash-project | ash_ai | bc2122f78fca6c11d8ec2b9ac53148ec17476460 ~ c68dfbdb220426dc015b58379e95bde8e9f0995a |
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-82580
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82580
请登录查看更多情报信息。
Other References for CVE-2026-82580 (4)
-
https://github.com/ash-project/ash_ai/security/advisories/GHSA-5747-6mpw-6m9c vendor-advisory related
Same Patch Batch · ash-project · 2026-08-31 · 13 CVEs total
| CVE-2026-77956 | 10.0 CRITICAL | EEx template evaluation of prompt content in AshAi enables remote code execution |
| CVE-2026-77850 | 8.4 HIGH | Stored XSS in AshAdmin relationship typeahead via unescaped label_field content |
| CVE-2026-82673 | 8.3 HIGH | Path traversal in AshAdmin file uploads via unsanitized client filename |
| CVE-2026-82722 | 8.3 HIGH | AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node D |
| CVE-2026-75757 | 8.3 HIGH | AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a |
| CVE-2026-81315 | 7.4 HIGH | MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header |
| CVE-2026-75760 | 7.1 HIGH | AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a us |
| CVE-2026-82564 | 7.1 HIGH | Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unident |
| CVE-2026-82579 | 6.0 MEDIUM | AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of |
| CVE-2026-81853 | 2.3 LOW | AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attrib |
| CVE-2026-81852 | 2.1 LOW | AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass |
| CVE-2026-82681 | 2.0 LOW | Query-parameter injection in AshAdmin row-action links via unencoded string primary keys |
IV. Related Vulnerabilities
Same product: ash_ai
-
CVE-2026-75760
AshAi vectorize change leaks raw embedding-provider errors, -
CVE-2026-82579
AshAi tool loop never terminates when all tool calls are fil -
CVE-2026-82564
Identity tool filter in AshAi accepts operator maps, allowin -
CVE-2026-81315
MCP DNS-rebinding origin check in AshAi is bypassed by a spo -
CVE-2026-77956
EEx template evaluation of prompt content in AshAi enables r
Same vendor: ash-project
-
CVE-2026-82673
Path traversal in AshAdmin file uploads via unsanitized clie -
CVE-2026-81853
AshAdmin composite primary key decoding accepts arbitrary fi -
CVE-2026-81852
AshAdmin ships a hardcoded CSP nonce, allowing nonce-based C -
CVE-2026-82681
Query-parameter injection in AshAdmin row-action links via u -
CVE-2026-77850
Stored XSS in AshAdmin relationship typeahead via unescaped
Same weakness: CWE-209
-
CVE-2026-75760
AshAi vectorize change leaks raw embedding-provider errors, -
CVE-2026-78693
Incomplete redaction re-attaches the original error path in -
CVE-2026-21809
HCL BigFix Quantum Risk Analyzer is affected by generating e -
CVE-2026-79777
rclone before v1.75.0 Information Disclosure via RC API -
CVE-2026-8173
Information Disclosure via 'Copy learned MAC Addresses' Func
V. Comments for CVE-2026-82580
No comments yet