ash (Hex)
Advisories
35
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.37.2 or later clears every advisory below that has a fix.
Upgrade commands
mix
{:ash, "~> 3.37.2"} # then: mix deps.update ashKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| EEF-CVE-2026-96581 An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records |
Not rated yet EPSS 0.26% |
>= 1.22.0, < 3.37.2 | 3.37.2 |
| EEF-CVE-2026-114214 Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records |
Not rated yet EPSS 0.25% |
>= 3.24.0, < 3.37.1 | 3.37.1 |
| EEF-CVE-2026-101028 Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts |
Not rated yet EPSS 0.34% |
>= 2.6.0, < 3.34.6 | 3.34.6 |
| EEF-CVE-2026-94201 Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash |
Not rated yet EPSS 0.30% |
>= 3.5.1, < 3.34.3 | 3.34.3 |
| EEF-CVE-2026-93477 Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash |
Not rated yet EPSS 0.20% |
>= 2.17.15, < 3.33.11 | 3.33.11 |
| EEF-CVE-2026-86338 Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle |
Not rated yet EPSS 0.43% |
>= 2.11.0-rc.0, < 3.33.4 | 3.33.4 |
| EEF-CVE-2026-82752 Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length |
Not rated yet EPSS 0.18% |
>= 0.10.0, < 3.33.0 | 3.33.0 |
| EEF-CVE-2026-82747 Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor |
Not rated yet EPSS 0.17% |
>= 3.4.44, < 3.32.2 | 3.32.2 |
| EEF-CVE-2026-82749 Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records |
Not rated yet EPSS 0.17% |
>= 3.13.2, < 3.32.2 | 3.32.2 |
| EEF-CVE-2026-82748 Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another |
Not rated yet EPSS 0.17% |
>= 3.5.13, < 3.32.2 | 3.32.2 |
| EEF-CVE-2026-82746 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records |
Not rated yet EPSS 0.17% |
>= 3.29.0, < 3.32.2 | 3.32.2 |
| EEF-CVE-2026-82745 ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness |
Not rated yet EPSS 0.17% |
>= 0.4.0, < 3.32.2 | 3.32.2 |
| EEF-CVE-2026-82744 Ash.Reactor change step fails open, skipping a change when its where guard raises |
Not rated yet EPSS 0.19% |
>= 3.0.0-rc.17, < 3.32.2 | 3.32.2 |
| EEF-CVE-2026-82743 Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads |
Not rated yet EPSS 0.18% |
>= 2.19.0, < 3.32.2 | 3.32.2 |
| EEF-CVE-2026-82742 Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory |
Not rated yet EPSS 0.18% |
>= 1.29.0-rc0, < 3.32.2 | 3.32.2 |
| EEF-CVE-2026-82741 Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion |
Not rated yet EPSS 0.19% |
>= 2.14.18, < 3.32.2 | 3.32.2 |
| EEF-CVE-2026-82740 Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs |
Not rated yet EPSS 0.18% |
>= 2.16.1, < 3.32.2 | 3.32.2 |
| EEF-CVE-2026-82739 Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error |
Not rated yet EPSS 0.18% |
>= 2.17.20, < 3.32.2 | 3.32.2 |
| EEF-CVE-2026-82738 Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service |
Not rated yet EPSS 0.18% |
>= 3.6.3, < 3.32.2 | 3.32.2 |
| EEF-CVE-2026-82737 Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads |
Not rated yet EPSS 0.18% |
>= 2.14.13, < 3.32.2 | 3.32.2 |
| EEF-CVE-2026-82736 Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass |
Not rated yet EPSS 0.18% |
>= 1.29.0-rc0, < 3.32.2 | 3.32.2 |
| EEF-CVE-2026-82735 Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service |
Not rated yet EPSS 0.18% |
>= 0.10.0, < 3.32.2 | 3.32.2 |
| EEF-CVE-2026-82734 Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal |
Not rated yet EPSS 0.19% |
>= 1.28.0, < 3.32.2 | 3.32.2 |
| EEF-CVE-2026-67579 Filter expression injection via forged keyset pagination cursor in Ash |
High EPSS 0.61% |
>= 1.17.0, < 3.31.3 | 3.31.3 |
| EEF-CVE-2026-70395 Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash |
Not rated yet EPSS 0.20% |
>= 1.52.0-rc.11, < 3.31.1 | 3.31.1 |
| EEF-CVE-2026-69659 Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset |
Medium EPSS 0.36% |
>= 1.17.0, < 3.31.1 | 3.31.1 |
| EEF-CVE-2026-55736 Private action arguments can be set by user input in Ash |
Medium EPSS 0.22% |
>= 3.0.0, < 3.29.3 | 3.29.3 |
| EEF-CVE-2026-55736 Private action arguments can be set by user input in Ash |
Medium EPSS 0.22% |
>= 3.0.0, < 3.29.3 | 3.29.3 |
| GHSA-jjf9-w5vj-r6vp Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash |
High EPSS 0.44% |
< 3.22.0 | 3.22.0 |
| EEF-CVE-2025-48044 Authorization bypass when bypass policy condition evaluates to true |
High EPSS 0.66% |
>= 3.6.3, < 3.7.1 | 3.7.1 |
| EEF-CVE-2025-48044 Authorization bypass when bypass policy condition evaluates to true |
High EPSS 0.66% |
>= 3.6.3, < 3.7.1 | 3.7.1 |
| EEF-CVE-2025-48043 Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization |
High EPSS 0.40% |
>= 0.1.1, < 3.6.2 | 3.6.2 |
| EEF-CVE-2025-48043 Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization |
High EPSS 0.40% |
< 3.6.2 | 3.6.2 |
| EEF-CVE-2025-48042 Before action hooks may execute in certain scenarios despite a request being forbidden |
Medium EPSS 0.34% |
>= 0.1.1, < 3.5.39 | 3.5.39 |
| EEF-CVE-2025-48042 Before action hooks may execute in certain scenarios despite a request being forbidden |
Medium EPSS 0.34% |
< 3.5.39 | 3.5.39 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor