EEF-CVE-2026-81852 CVE-2026-81852 GHSA-whfj-rrrp-j597
AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass
- Severity
- 0.0 / 10
- Unknown · CVSS 4.0
- Exploit chance (EPSS)
- 0.53%
- Chance of exploitation in the next 30 days. Higher than 44.70% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-330 Use of Insufficiently Random Values
- Fix
1.3.1- Upgrade ash_admin to this version or later
Description
Summary
Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.
When mounted without :csp_nonce_assign_key, AshAdmin.Router.ash_admin/2 defaulted the img, style, and script nonces to the literal constant ash_admin-Ed55GFnX, which AshAdmin.Layouts wrote verbatim into the nonce attribute of its inline <style> and <script> tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application's CSP script-src allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.
This issue affects ash_admin: from 0.10.8 before 1.3.1.
Configurations
The application mounts AshAdmin without :csp_nonce_assign_key and enforces a nonce-based CSP whose script-src allow-lists the default ash_admin-Ed55GFnX value, and has a separate HTML-injection sink on an admin page.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| ash_admin | >= 0.10.8, < 1.3.1 |
1.3.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ash_admin Hex → 1.3.1
- mix
{:ash_admin, "~> 1.3.1"} # then: mix deps.update ash_admin
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- Active
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-330: Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
How to prevent it
- Architecture and Design: Use a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts. Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.
- Implementation: Consider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.
- Architecture and Design, Requirements: Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-82673 Path traversal in AshAdmin file uploads via unsanitized client filename | Not rated yet | Also affects ash_admin |
| EEF-CVE-2026-81853 AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle | Not rated yet | Also affects ash_admin |
| EEF-CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys | Not rated yet | Also affects ash_admin |
| EEF-CVE-2026-77850 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content | Not rated yet | Also affects ash_admin |
| EEF-CVE-2026-82722 AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS) | Not rated yet | Also affects ash_admin |
| EEF-CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain | Not rated yet | Also affects ash_admin |
| GHSA-qv2q-c278-pch5 ImageMagick: Information Disclosure in PasskeyEncipherImage via AES-CTR nonce reuse | Medium | Same weakness, CWE-330 |
| GHSA-2rhw-gw3f-477j DNN: Same HostGUID for all new installs | Medium | Same weakness, CWE-330 |
Credits: Jonatan Männchen / EEF, Peter Ullrich, Zach Daniel / Ash Project
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor