ash_graphql (Hex)
Advisories
6
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 1.11.0 or later clears every advisory below that has a fix.
Upgrade commands
mix
{:ash_graphql, "~> 1.11.0"} # then: mix deps.update ash_graphqlKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| EEF-CVE-2026-78693 Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names |
Not rated yet EPSS 0.52% |
>= 1.9.0, < 1.11.0 | 1.11.0 |
| EEF-CVE-2026-80223 Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read |
Not rated yet EPSS 0.43% |
>= 1.4.0, < 1.11.0 | 1.11.0 |
| EEF-CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service |
Not rated yet EPSS 0.55% |
>= 0.16.23, < 1.11.0 | 1.11.0 |
| EEF-CVE-2026-81633 Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment |
Not rated yet EPSS 0.52% |
>= 0.27.0, < 1.11.0 | 1.11.0 |
| EEF-CVE-2026-81643 Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification |
Not rated yet EPSS 0.43% |
>= 1.4.0, < 1.11.0 | 1.11.0 |
| EEF-CVE-2026-82367 Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic |
Not rated yet EPSS 0.39% |
>= 1.4.0, < 1.11.0 | 1.11.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor