Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

ash — Vulnerabilities & Security Advisories 8

All 8 CVE vulnerabilities found in ash, with AI-generated Chinese analysis, references, and POCs.

Vendor: ash-project

CVE ID Title CVSS Severity Published
CVE-2026-67579 Filter expression injection via forged keyset pagination cursor in Ash CWE-502 7.5 High 2026-08-12
CVE-2026-70395 Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash CWE-943 2.1 Low 2026-08-09
CVE-2026-69659 Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset CWE-502 5.9 Medium 2026-08-09
CVE-2026-55736 Private action arguments can be set by user input in Ash CWE-915 - - 2026-06-23
CVE-2026-34593 Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash CWE-400 6.5AI Medium AI 2026-04-02
CVE-2025-48044 Authorization bypass when bypass policy condition evaluates to true CWE-863 8.6 High 2025-10-17
CVE-2025-48043 Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization CWE-863 8.6 High 2025-10-10
CVE-2025-48042 Before action hooks may execute in certain scenarios despite a request being forbidden CWE-863 7.1 High 2025-09-07

All 8 known CVE vulnerabilities affecting ash with full Chinese analysis, references, and POCs where available.