ash_sql (Hex)
Advisories
5
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.7.1 or later clears every advisory below that has a fix.
Upgrade commands
mix
{:ash_sql, "~> 0.7.1"} # then: mix deps.update ash_sqlKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| EEF-CVE-2026-77454 exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql |
Not rated yet EPSS 0.18% |
>= 0.4.1, < 0.7.1 | 0.7.1 |
| EEF-CVE-2026-81316 Same-named aggregates with differing filters are conflated in AshSql |
Not rated yet EPSS 0.17% |
>= 0.1.0, < 0.7.1 | 0.7.1 |
| EEF-CVE-2026-81318 Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql |
Not rated yet EPSS 0.17% |
>= 0.1.0, < 0.7.1 | 0.7.1 |
| EEF-CVE-2026-78691 Unescaped backslash allows LIKE wildcard injection in AshSql string search |
Not rated yet EPSS 0.20% |
>= 0.1.1-rc.10, < 0.7.1 | 0.7.1 |
| EEF-CVE-2026-80227 SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql |
Not rated yet EPSS 0.37% |
>= 0.1.0, < 0.7.1 | 0.7.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor