Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

ash-project — Vulnerabilities & Security Advisories 86

Browse all 86 CVE security advisories affecting ash-project. AI-powered Chinese analysis, POCs, and references for each vulnerability.

The ash-project is a Python-based security tool for analyzing shell scripts to detect vulnerabilities and security issues. Historically, it has been susceptible to multiple remote code execution (RCE) vulnerabilities, cross-site scripting (XSS) flaws, and privilege escalation issues, as evidenced by its six recorded CVEs. The tool's static analysis approach sometimes fails to properly sanitize input or handle complex shell constructs, leading to potential bypasses. While no major public security incidents have been documented, the consistent discovery of similar vulnerability classes suggests ongoing challenges in accurately parsing diverse shell script syntaxes and ensuring comprehensive security coverage.

Found 29 results / 86 Clear Filters
Top products by ash-project: ash ash_ai ash_typescript ash_admin ash_graphql ash_authentication_oauth2_server ash_sql ash_phoenix ash_paper_trail ash_oban ash_cloak ash_postgres ash_lua ash_sqlite igniter ash_double_entry usage_rules
CVE ID Title CVSS Severity Published
CVE-2026-101028 Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts — ash CWE-863 6.0 Medium 2026-10-09
CVE-2026-94201 Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash — ash CWE-770 8.2 High 2026-10-05
CVE-2026-93477 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash — ash CWE-915 5.9 Medium 2026-09-25
CVE-2026-86338 Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle — ash CWE-1220 6.0 Medium 2026-09-16
CVE-2026-82752 Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length — ash CWE-1284 5.9 Medium 2026-09-05
CVE-2026-82747 Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor — ash CWE-863 5.9 Medium 2026-09-01
CVE-2026-82749 Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records — ash CWE-863 5.9 Medium 2026-09-01
CVE-2026-82748 Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another — ash CWE-863 2.1 Low 2026-09-01
CVE-2026-82746 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records — ash CWE-862 5.9 Medium 2026-09-01
CVE-2026-82745 ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness — ash CWE-284 5.9 Medium 2026-09-01
CVE-2026-82744 Ash.Reactor change step fails open, skipping a change when its where guard raises — ash CWE-636 2.1 Low 2026-09-01
CVE-2026-82743 Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads — ash CWE-400 2.1 Low 2026-09-01
CVE-2026-82742 Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory — ash CWE-400 5.9 Medium 2026-09-01
CVE-2026-82741 Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion — ash CWE-1287 2.1 Low 2026-09-01
CVE-2026-82740 Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs — ash CWE-20 2.1 Low 2026-09-01
CVE-2026-82739 Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error — ash CWE-209 2.1 Low 2026-09-01
CVE-2026-82738 Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service — ash CWE-20 5.9 Medium 2026-09-01
CVE-2026-82737 Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads — ash CWE-190 5.9 Medium 2026-09-01
CVE-2026-82736 Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass — ash CWE-180 2.1 Low 2026-09-01
CVE-2026-82735 Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service — ash CWE-400 5.9 Medium 2026-09-01
CVE-2026-82734 Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal — ash CWE-1284 2.1 Low 2026-09-01
CVE-2026-67579 Filter expression injection via forged keyset pagination cursor in Ash — ash CWE-502 7.5 High 2026-08-12
CVE-2026-70395 Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash — ash CWE-943 2.1 Low 2026-08-09
CVE-2026-69659 Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset — ash CWE-502 5.9 Medium 2026-08-09
CVE-2026-55736 Private action arguments can be set by user input in Ash — ash CWE-915 - - 2026-06-23
CVE-2026-34593 Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash — ash CWE-400 6.5AI Medium AI 2026-04-02
CVE-2025-48044 Authorization bypass when bypass policy condition evaluates to true — ash CWE-863 8.6 High 2025-10-17
CVE-2025-48043 Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization — ash CWE-863 8.6 High 2025-10-10
CVE-2025-48042 Before action hooks may execute in certain scenarios despite a request being forbidden — ash CWE-863 7.1 High 2025-09-07

This page lists every published CVE security advisory associated with ash-project. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.