ash_postgres (Hex)
Advisories
4
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.15.2 or later clears every advisory below that has a fix.
Upgrade commands
mix
{:ash_postgres, "~> 2.15.2"} # then: mix deps.update ash_postgresKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| EEF-CVE-2026-115627 AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows |
Not rated yet EPSS 0.25% |
>= 0.38.0, < 2.15.2 | 2.15.2 |
| EEF-CVE-2026-115635 AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set |
Not rated yet EPSS 0.25% |
>= 2.6.22, < 2.15.2 | 2.15.2 |
| EEF-CVE-2026-78699 rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres |
Not rated yet EPSS 0.16% |
>= 0.25.0, < 2.13.0 | 2.13.0 |
| GHSA-hf59-7rwq-785m In AshPostgres, empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability. |
Medium EPSS 0.51% |
>= 2.0.0, < 2.4.10 | 2.4.10 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor