Browse all 86 CVE security advisories affecting ash-project. AI-powered Chinese analysis, POCs, and references for each vulnerability.
The ash-project is a Python-based security tool for analyzing shell scripts to detect vulnerabilities and security issues. Historically, it has been susceptible to multiple remote code execution (RCE) vulnerabilities, cross-site scripting (XSS) flaws, and privilege escalation issues, as evidenced by its six recorded CVEs. The tool's static analysis approach sometimes fails to properly sanitize input or handle complex shell constructs, leading to potential bypasses. While no major public security incidents have been documented, the consistent discovery of similar vulnerability classes suggests ongoing challenges in accurately parsing diverse shell script syntaxes and ensuring comprehensive security coverage.
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-82725 | AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data — ash_phoenix CWE-639 | 2.3 | Low | 2026-08-31 |
| CVE-2026-82724 | Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain — ash_phoenix CWE-863 | 7.6 | High | 2026-08-31 |
| CVE-2026-82726 | AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant — ash_phoenix CWE-625 | 6.3 | Medium | 2026-08-31 |
| CVE-2026-82727 | AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message — ash_phoenix CWE-209 | 2.3 | Low | 2026-08-31 |
This page lists every published CVE security advisory associated with ash-project. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.