ash_admin (Hex)
Advisories
7
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.3.1 or later clears every advisory below that has a fix.
Upgrade commands
mix
{:ash_admin, "~> 1.3.1"} # then: mix deps.update ash_adminKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| EEF-CVE-2026-82673 Path traversal in AshAdmin file uploads via unsanitized client filename |
Not rated yet EPSS 0.79% |
>= 0.13.7, < 1.3.1 | 1.3.1 |
| EEF-CVE-2026-81853 AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle |
Not rated yet EPSS 0.45% |
>= 0.1.0, < 1.3.1 | 1.3.1 |
| EEF-CVE-2026-81852 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass |
Not rated yet EPSS 0.53% |
>= 0.10.8, < 1.3.1 | 1.3.1 |
| EEF-CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys |
Not rated yet EPSS 0.47% |
>= 0.3.0-rc.0, < 1.3.1 | 1.3.1 |
| EEF-CVE-2026-77850 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content |
Not rated yet EPSS 0.48% |
>= 0.13.0, < 1.3.1 | 1.3.1 |
| EEF-CVE-2026-82722 AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS) |
Not rated yet EPSS 0.47% |
>= 0.1.0, < 1.3.1 | 1.3.1 |
| EEF-CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain |
Not rated yet EPSS 0.52% |
>= 0.9.1, < 1.3.1 | 1.3.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor