EEF-CVE-2026-82733 CVE-2026-82733 GHSA-ghhw-qh7p-55xr
Route handler return value echoed into AshTypescript error response
- Severity
- 0.0 / 10
- Unknown · CVSS 4.0
- Exploit chance (EPSS)
- 0.55%
- Chance of exploitation in the next 30 days. Higher than 45.85% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-209 Generation of Error Message Containing Sensitive Information
- Fix
0.18.0- Upgrade ash_typescript to this version or later
Description
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body.
When a typed-controller route handler returns anything other than a %Plug.Conn{}, dispatch/3 in lib/ash_typescript/typed_controller/request_handler.ex passes the value to unexpected_return/2, which interpolates inspect(value, limit: 50) directly into the response message. The limit option bounds elements per collection rather than the term as a whole, so a handler falling through with a term such as {:error, %User{}} or a changeset serialises its full field set, including hashed passwords, tokens, and tenant identifiers, into the JSON error returned to the caller.
This contradicts the module's own posture elsewhere: the rescue clause gates Exception.message/1 behind AshTypescript.typed_controller_show_raised_errors?/0 and otherwise returns a generic message, while this path is ungated and always echoes.
This issue affects ash_typescript: from 0.15.0 before 0.18.0.
Configurations
The application exposes an AshTypescript typed controller over HTTP with a route handler that can return a non-Plug.Conn term carrying sensitive data.
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| ash_typescript | >= 0.15.0, < 0.18.0 |
0.18.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ash_typescript Hex → 0.18.0
- mix
{:ash_typescript, "~> 0.18.0"} # then: mix deps.update ash_typescript
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-209: Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.
How to prevent it
- Implementation: Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
- Implementation: Handle exceptions internally and do not display errors containing potentially sensitive information to a user.
- Implementation: Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
- Implementation, Build and Compilation: Debugging information should not make its way into a production release.
- Implementation, Build and Compilation: Debugging information should not make its way into a production release.
- System Configuration: Where available, configure the environment to use less verbose error messages. For example, in PHP, disable the display_errors setting during configuration, or at runtime using the error_reporting() function.
- System Configuration: Create default error pages or messages that do not leak any information.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-105283 Internal error terms inspected into AshTypescript RPC error responses | Not rated yet | Also affects ash_typescript |
| EEF-CVE-2026-82731 Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection | Not rated yet | Also affects ash_typescript |
| EEF-CVE-2026-74837 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter | Not rated yet | Also affects ash_typescript |
| EEF-CVE-2026-82732 Declared argument constraints not enforced on AshTypescript typed controller routes | Not rated yet | Also affects ash_typescript |
| EEF-CVE-2026-82730 Authorization-redacted field values disclosed through AshTypescript result normalization | Not rated yet | Also affects ash_typescript |
| EEF-CVE-2026-77950 RPC error handler fails open in AshTypescript, disclosing unredacted errors | Not rated yet | Also affects ash_typescript |
| EEF-CVE-2026-77856 Unbounded atom creation from typed struct field names in AshTypescript field selector | Not rated yet | Also affects ash_typescript |
| GHSA-vfpm-58rq-9qcg Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` | Medium | Same weakness, CWE-209 |
Credits: Jonatan Männchen / EEF, Peter Ullrich, Torkild Gundersen Kjevik / Ash Project
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor