Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-82586— AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

Quick assessment

Affected
ash-project ash_lua
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

翻译： ash-project 中 ash_lua 存在“替代路径保护不当”漏洞，允许用户提供的 Lua 脚本读取不在公开字段白名单中的属性。 AshLua 将 Ash 资源暴露给 Lua 脚本，其暴露范围由一个清单（manifest）定义，该清单声明了哪些字段是公开的。然而，AshLua.Runtime 中 read 操作所使用的聚合路径（aggregate path）在解析字段时，直接取自 Lua 调用中的字段名，并通过 和 进行解析，这两个环节均未参考常规字段路径所执行的公开字段白名单。因此，脚本可以读取任何

CVSS 8.2 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82586

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's operation aggregate path in AshLua.Runtime took the field name straight from the Lua call and resolved it with only String.to_existing_atom and Ash.Query.Aggregate.new!, neither of which consults the exposed-field allow-list the normal fields path enforces. A script can therefore read the value of any attribute of any record the actor may read, including private sensitive?: true columns, via resource.read({ operation = {"list", "hashed_password"} }); min and max give a value oracle. Anyone able to submit or influence a Lua script can reach this. This issue affects ash_lua: from 0.1.0 before 0.2.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对候选路径的不恰当保护
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ash-project ash_lua 0.1.0 ~ 0.2.1 cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*
ash-project ash_lua 8675e47cca81f36594083a7e63379bac9e123e72 ~ c0dfcd9494766d548178c37df0bd01cff378e1c7 cpe:2.3:a:ash-project:ash_lua:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-82586

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82586

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-82586 (1)

Vendor Advisories for CVE-2026-82586 (1)

Other References for CVE-2026-82586 (2)

Same Patch Batch · ash-project · 2026-09-07 · 9 CVEs total

CVE-2026-82753 8.2 HIGH Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and c
CVE-2026-82755 6.3 MEDIUM ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheab
CVE-2026-82758 6.3 MEDIUM ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gat
CVE-2026-82754 6.3 MEDIUM ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypas
CVE-2026-82757 6.3 MEDIUM ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addre
CVE-2026-82756 6.3 MEDIUM ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenti
CVE-2026-82584 2.3 LOW Terminal escape sequence injection in the mix igniter.install confirmation prompt via pack
CVE-2026-81638 2.1 LOW Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

IV. Related Vulnerabilities

Same vendor: ash-project
Same weakness: CWE-424

V. Comments for CVE-2026-82586

No comments yet

Leave a comment