EEF-CVE-2026-77950 CVE-2026-77950 GHSA-mjr7-r3rf-x963
RPC error handler fails open in AshTypescript, disclosing unredacted errors
- Severity
- 0.0 / 10
- Unknown · CVSS 4.0
- Exploit chance (EPSS)
- 0.55%
- Chance of exploitation in the next 30 days. Higher than 45.85% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-209 Generation of Error Message Containing Sensitive Information
- Fix
0.18.0- Upgrade ash_typescript to this version or later
Description
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match.
apply_error_handler/3 in lib/ash_typescript/rpc/errors.ex is the only hook an application has for redacting or suppressing errors before they reach the client, with a nil return dropping the error entirely. Its rescue clause logs a warning and then returns the original, pre-handler error map. Error handlers are conventionally written as pattern-matching functions over expected error shapes, so an unmatched shape raises FunctionClauseError and the raw transformed error, including any secrets carried in vars, is emitted instead. An intent to suppress an error becomes an intent to publish it. The rescue catches exceptions only, so a handler that throws or exits still propagates.
This issue affects ash_typescript: from 0.8.0 before 0.18.0.
Configurations
The application exposes an AshTypescript RPC endpoint over HTTP and configures a custom error_handler in its typescript_rpc domain section for redaction or suppression.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| ash_typescript | >= 0.8.0, < 0.18.0 |
0.18.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ash_typescript Hex → 0.18.0
- mix
{:ash_typescript, "~> 0.18.0"} # then: mix deps.update ash_typescript
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-209: Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
How to prevent it
- Implementation: Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
- Implementation: Handle exceptions internally and do not display errors containing potentially sensitive information to a user.
- Implementation: Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
- Implementation, Build and Compilation: Debugging information should not make its way into a production release.
- Implementation, Build and Compilation: Debugging information should not make its way into a production release.
- System Configuration: Where available, configure the environment to use less verbose error messages. For example, in PHP, disable the display_errors setting during configuration, or at runtime using the error_reporting() function.
- System Configuration: Create default error pages or messages that do not leak any information.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-105283 Internal error terms inspected into AshTypescript RPC error responses | Not rated yet | Also affects ash_typescript |
| EEF-CVE-2026-82731 Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection | Not rated yet | Also affects ash_typescript |
| EEF-CVE-2026-74837 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter | Not rated yet | Also affects ash_typescript |
| EEF-CVE-2026-82733 Route handler return value echoed into AshTypescript error response | Not rated yet | Also affects ash_typescript |
| EEF-CVE-2026-82732 Declared argument constraints not enforced on AshTypescript typed controller routes | Not rated yet | Also affects ash_typescript |
| EEF-CVE-2026-82730 Authorization-redacted field values disclosed through AshTypescript result normalization | Not rated yet | Also affects ash_typescript |
| EEF-CVE-2026-77856 Unbounded atom creation from typed struct field names in AshTypescript field selector | Not rated yet | Also affects ash_typescript |
| GHSA-vfpm-58rq-9qcg Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` | Medium | Same weakness, CWE-209 |
Credits: Jonatan Männchen / EEF, Peter Ullrich, Torkild Gundersen Kjevik / Ash Project
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor