All 7 CVE vulnerabilities found in ash_ai, with AI-generated Chinese analysis, references, and POCs.
Vendor: ash-project
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-78230 | AshAi aggregate tool can read field-policy-protected fields CWE-1220 | 6.0 | Medium | 2026-09-08 |
| CVE-2026-75760 | AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error CWE-209 | 7.1 | High | 2026-08-31 |
| CVE-2026-82580 | AshAi echoes raw tool exception messages into the conversation, disclosing internal details CWE-209 | 5.3 | Medium | 2026-08-31 |
| CVE-2026-82579 | AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service CWE-835 | 6.0 | Medium | 2026-08-31 |
| CVE-2026-82564 | Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records CWE-639 | 7.1 | High | 2026-08-31 |
| CVE-2026-81315 | MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header CWE-346 | 7.4 | High | 2026-08-31 |
| CVE-2026-77956 | EEx template evaluation of prompt content in AshAi enables remote code execution CWE-94 | 8.9 | High | 2026-08-31 |
All 7 known CVE vulnerabilities affecting ash_ai with full Chinese analysis, references, and POCs where available.