# Hex Advisories.

Every Hex Advisory we hold (Elixir · Erlang), newest first.

## Records, newest first (an older page)

- [Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion](https://agentprime.io/advisories/GHSA-2mmm-gc86-7jgg.md)
  `GHSA-2mmm-gc86-7jgg`, `CVE-2026-82741`, `EEF-CVE-2026-82741` · Hex `ash`: affected `>=2.14.18, <3.32.2`, fixed in `3.32.2` · CVSS 2.1 Low · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-1287
- [Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs](https://agentprime.io/advisories/GHSA-v29m-p28g-w5fc.md)
  `GHSA-v29m-p28g-w5fc`, `CVE-2026-82740`, `EEF-CVE-2026-82740` · Hex `ash`: affected `>=2.16.1, <3.32.2`, fixed in `3.32.2` · CVSS 2.1 Low · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-20
- [Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error](https://agentprime.io/advisories/GHSA-66cg-vj5m-8w7v.md)
  `GHSA-66cg-vj5m-8w7v`, `CVE-2026-82739`, `EEF-CVE-2026-82739` · Hex `ash`: affected `>=2.17.20, <3.32.2`, fixed in `3.32.2` · CVSS 2.1 Low · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure
- [Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service](https://agentprime.io/advisories/GHSA-7xfw-9jwm-9c4c.md)
  `GHSA-7xfw-9jwm-9c4c`, `CVE-2026-82738`, `EEF-CVE-2026-82738` · Hex `ash`: affected `>=3.6.3, <3.32.2`, fixed in `3.32.2` · CVSS 5.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-20
- [Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads](https://agentprime.io/advisories/GHSA-68q3-w4w3-2gfv.md)
  `GHSA-68q3-w4w3-2gfv`, `CVE-2026-82737`, `EEF-CVE-2026-82737` · Hex `ash`: affected `>=2.14.13, <3.32.2`, fixed in `3.32.2` · CVSS 5.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass](https://agentprime.io/advisories/GHSA-gg9w-7593-hxg9.md)
  `GHSA-gg9w-7593-hxg9`, `CVE-2026-82736`, `EEF-CVE-2026-82736` · Hex `ash`: affected `>=1.29.0-rc0, <3.32.2`, fixed in `3.32.2` · CVSS 2.1 Low · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-180
- [Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service](https://agentprime.io/advisories/GHSA-mq7g-pffw-m8xh.md)
  `GHSA-mq7g-pffw-m8xh`, `CVE-2026-82735`, `EEF-CVE-2026-82735` · Hex `ash`: affected `>=0.10.0, <3.32.2`, fixed in `3.32.2` · CVSS 5.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service
- [Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal](https://agentprime.io/advisories/GHSA-mvvh-q33h-q62v.md)
  `GHSA-mvvh-q33h-q62v`, `CVE-2026-82734`, `EEF-CVE-2026-82734` · Hex `ash`: affected `>=1.28.0, <3.32.2`, fixed in `3.32.2` · CVSS 2.1 Low · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-1284
- [Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection](https://agentprime.io/advisories/GHSA-6g23-p936-fm2f.md)
  `GHSA-6g23-p936-fm2f`, `CVE-2026-82731`, `EEF-CVE-2026-82731` · Hex `ash_typescript`: affected `>=0.15.0, <0.18.0`, fixed in `0.18.0` · CVSS 2.3 Low · Not analysed yet · Published 1 Sept 2026 · Tags: Open redirect
- [Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter](https://agentprime.io/advisories/GHSA-mhxc-mhqx-3v28.md)
  `GHSA-mhxc-mhqx-3v28`, `CVE-2026-74837`, `EEF-CVE-2026-74837` · Hex `ash_typescript`: affected `>=0.1.0, <0.18.0`, fixed in `0.18.0` · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service
- [Route handler return value echoed into AshTypescript error response](https://agentprime.io/advisories/GHSA-ghhw-qh7p-55xr.md)
  `GHSA-ghhw-qh7p-55xr`, `CVE-2026-82733`, `EEF-CVE-2026-82733` · Hex `ash_typescript`: affected `>=0.15.0, <0.18.0`, fixed in `0.18.0` · CVSS 6.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure
- [Declared argument constraints not enforced on AshTypescript typed controller routes](https://agentprime.io/advisories/GHSA-f7fq-hwq6-jhvv.md)
  `GHSA-f7fq-hwq6-jhvv`, `CVE-2026-82732`, `EEF-CVE-2026-82732` · Hex `ash_typescript`: affected `>=0.15.0, <0.18.0`, fixed in `0.18.0` · CVSS 6.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-20
- [Authorization-redacted field values disclosed through AshTypescript result normalization](https://agentprime.io/advisories/GHSA-6929-rjmh-4x62.md)
  `GHSA-6929-rjmh-4x62`, `CVE-2026-82730`, `EEF-CVE-2026-82730` · Hex `ash_typescript`: affected `>=0.11.0, <0.18.0`, fixed in `0.18.0` · CVSS 8.2 High · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [RPC error handler fails open in AshTypescript, disclosing unredacted errors](https://agentprime.io/advisories/GHSA-mjr7-r3rf-x963.md)
  `GHSA-mjr7-r3rf-x963`, `CVE-2026-77950`, `EEF-CVE-2026-77950` · Hex `ash_typescript`: affected `>=0.8.0, <0.18.0`, fixed in `0.18.0` · CVSS 6.3 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure
- [Unbounded atom creation from typed struct field names in AshTypescript field selector](https://agentprime.io/advisories/GHSA-rj47-h936-4cxw.md)
  `GHSA-rj47-h936-4cxw`, `CVE-2026-77856`, `EEF-CVE-2026-77856` · Hex `ash_typescript`: affected `>=0.11.0, <0.18.0`, fixed in `0.18.0` · CVSS 8.2 High · Not analysed yet · Published 1 Sept 2026 · Tags: Denial of service
- [AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data](https://agentprime.io/advisories/GHSA-7xhg-xphm-f458.md)
  `GHSA-7xhg-xphm-f458`, `CVE-2026-82725`, `EEF-CVE-2026-82725` · Hex `ash_phoenix`: affected `>=0.6.0-rc.1, <2.3.25`, fixed in `2.3.25` · CVSS 2.3 Low · Not analysed yet · Published 31 Aug 2026 · Tags: Broken access control
- [Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain](https://agentprime.io/advisories/GHSA-39c8-xcwr-gqff.md)
  `GHSA-39c8-xcwr-gqff`, `CVE-2026-82724`, `EEF-CVE-2026-82724` · Hex `ash_phoenix`: affected `>=2.1.26, <2.3.25`, fixed in `2.3.25` · CVSS 7.6 High · Not analysed yet · Published 31 Aug 2026 · Tags: Broken access control
- [AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant](https://agentprime.io/advisories/GHSA-rpf8-q9jh-qxrr.md)
  `GHSA-rpf8-q9jh-qxrr`, `CVE-2026-82726`, `EEF-CVE-2026-82726` · Hex `ash_phoenix`: affected `>=2.1.26, <2.3.25`, fixed in `2.3.25` · CVSS 6.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: CWE-178, CWE-625
- [AshPhoenix Form.Auto leaks submitted params in an unknown \_union_type error message](https://agentprime.io/advisories/GHSA-5xf4-hgcq-xw7v.md)
  `GHSA-5xf4-hgcq-xw7v`, `CVE-2026-82727`, `EEF-CVE-2026-82727` · Hex `ash_phoenix`: affected `>=1.2.17, <2.3.25`, fixed in `2.3.25` · CVSS 2.3 Low · Not analysed yet · Published 31 Aug 2026 · Tags: Information disclosure
- [Path traversal in AshAdmin file uploads via unsanitized client filename](https://agentprime.io/advisories/GHSA-483p-rgcq-p5j9.md)
  `GHSA-483p-rgcq-p5j9`, `CVE-2026-82673`, `EEF-CVE-2026-82673` · Hex `ash_admin`: affected `>=0.13.7, <1.3.1`, fixed in `1.3.1` · CVSS 8.3 High · Not analysed yet · Published 31 Aug 2026 · Tags: Path traversal
- [AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle](https://agentprime.io/advisories/GHSA-jxr8-hpv2-qp38.md)
  `GHSA-jxr8-hpv2-qp38`, `CVE-2026-81853`, `EEF-CVE-2026-81853` · Hex `ash_admin`: affected `>=0.1.0, <1.3.1`, fixed in `1.3.1` · CVSS 2.3 Low · Not analysed yet · Published 31 Aug 2026 · Tags: Broken access control
- [AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass](https://agentprime.io/advisories/GHSA-whfj-rrrp-j597.md)
  `GHSA-whfj-rrrp-j597`, `CVE-2026-81852`, `EEF-CVE-2026-81852` · Hex `ash_admin`: affected `>=0.10.8, <1.3.1`, fixed in `1.3.1` · CVSS 2.1 Low · Not analysed yet · Published 31 Aug 2026 · Tags: Weak cryptography or TLS
- [Query-parameter injection in AshAdmin row-action links via unencoded string primary keys](https://agentprime.io/advisories/GHSA-j89q-xjrh-c26p.md)
  `GHSA-j89q-xjrh-c26p`, `CVE-2026-82681`, `EEF-CVE-2026-82681` · Hex `ash_admin`: affected `>=0.3.0-rc.0, <1.3.1`, fixed in `1.3.1` · CVSS 2.0 Low · Not analysed yet · Published 31 Aug 2026 · Tags: CWE-116
- [Stored XSS in AshAdmin relationship typeahead via unescaped label_field content](https://agentprime.io/advisories/GHSA-m23x-576h-73w8.md)
  `GHSA-m23x-576h-73w8`, `CVE-2026-77850`, `EEF-CVE-2026-77850` · Hex `ash_admin`: affected `>=0.13.0, <1.3.1`, fixed in `1.3.1` · CVSS 8.4 High · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS)
- [AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)](https://agentprime.io/advisories/GHSA-wcr6-9rrw-5jhv.md)
  `GHSA-wcr6-9rrw-5jhv`, `CVE-2026-82722`, `EEF-CVE-2026-82722` · Hex `ash_admin`: affected `>=0.1.0, <1.3.1`, fixed in `1.3.1` · CVSS 8.3 High · Not analysed yet · Published 31 Aug 2026 · Tags: Denial of service
- [AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain](https://agentprime.io/advisories/GHSA-3259-55fp-w94j.md)
  `GHSA-3259-55fp-w94j`, `CVE-2026-75757`, `EEF-CVE-2026-75757` · Hex `ash_admin`: affected `>=0.9.1, <1.3.1`, fixed in `1.3.1` · CVSS 8.3 High · Not analysed yet · Published 31 Aug 2026 · Tags: CWE-565
- [AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error](https://agentprime.io/advisories/GHSA-p5cr-mmmf-6w39.md)
  `GHSA-p5cr-mmmf-6w39`, `CVE-2026-75760`, `EEF-CVE-2026-75760` · Hex `ash_ai`: affected `>=0.1.0, <1.0.0`, fixed in `1.0.0` · CVSS 7.1 High · Not analysed yet · Published 31 Aug 2026 · Tags: Information disclosure
- [AshAi echoes raw tool exception messages into the conversation, disclosing internal details](https://agentprime.io/advisories/GHSA-5747-6mpw-6m9c.md)
  `GHSA-5747-6mpw-6m9c`, `CVE-2026-82580`, `EEF-CVE-2026-82580` · Hex `ash_ai`: affected `>=0.6.0, <1.0.0`, fixed in `1.0.0` · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Information disclosure
- [AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service](https://agentprime.io/advisories/GHSA-rcx7-x2w5-mmc2.md)
  `GHSA-rcx7-x2w5-mmc2`, `CVE-2026-82579`, `EEF-CVE-2026-82579` · Hex `ash_ai`: affected `>=0.6.0, <1.0.0`, fixed in `1.0.0` · CVSS 6.0 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Denial of service
- [Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records](https://agentprime.io/advisories/GHSA-jg86-xh36-h5xc.md)
  `GHSA-jg86-xh36-h5xc`, `CVE-2026-82564`, `EEF-CVE-2026-82564` · Hex `ash_ai`: affected `>=0.6.0, <1.0.0`, fixed in `1.0.0` · CVSS 7.1 High · Not analysed yet · Published 31 Aug 2026 · Tags: Broken access control
- [MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header](https://agentprime.io/advisories/GHSA-c92r-f3rr-q49h.md)
  `GHSA-c92r-f3rr-q49h`, `CVE-2026-81315`, `EEF-CVE-2026-81315` · Hex `ash_ai`: affected `>=0.8.0, <1.0.0`, fixed in `1.0.0` · CVSS 7.4 High · Not analysed yet · Published 31 Aug 2026 · Tags: CWE-346
- [EEx template evaluation of prompt content in AshAi enables remote code execution](https://agentprime.io/advisories/GHSA-2g59-hg7m-qc83.md)
  `GHSA-2g59-hg7m-qc83`, `CVE-2026-77956`, `EEF-CVE-2026-77956` · Hex `ash_ai`: affected `>=0.1.0, <1.0.0`, fixed in `1.0.0` · CVSS 8.9 High · Not analysed yet · Published 31 Aug 2026 · Tags: Code injection
- [Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names](https://agentprime.io/advisories/GHSA-ppr2-g9h8-w7qp.md)
  `GHSA-ppr2-g9h8-w7qp`, `CVE-2026-78693`, `EEF-CVE-2026-78693` · Hex `ash_graphql`: affected `>=1.9.0, <1.11.0`, fixed in `1.11.0` · CVSS 6.9 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Information disclosure
- [Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read](https://agentprime.io/advisories/GHSA-rcqc-59g2-gjg2.md)
  `GHSA-rcqc-59g2-gjg2`, `CVE-2026-80223`, `EEF-CVE-2026-80223` · Hex `ash_graphql`: affected `>=1.4.0, <1.11.0`, fixed in `1.11.0` · CVSS 7.1 High · Not analysed yet · Published 30 Aug 2026 · Tags: Broken access control
- [Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service](https://agentprime.io/advisories/GHSA-mwc4-r9fc-h6mg.md)
  `GHSA-mwc4-r9fc-h6mg`, `CVE-2026-81636`, `EEF-CVE-2026-81636` · Hex `ash_graphql`: affected `>=0.16.23, <1.11.0`, fixed in `1.11.0` · CVSS 8.7 High · Not analysed yet · Published 30 Aug 2026 · Tags: Denial of service
- [Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment](https://agentprime.io/advisories/GHSA-mrgv-g7gf-r96h.md)
  `GHSA-mrgv-g7gf-r96h`, `CVE-2026-81633`, `EEF-CVE-2026-81633` · Hex `ash_graphql`: affected `>=0.27.0, <1.11.0`, fixed in `1.11.0` · CVSS 6.9 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: CWE-20
- [Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification](https://agentprime.io/advisories/GHSA-j684-hch4-q888.md)
  `GHSA-j684-hch4-q888`, `CVE-2026-81643`, `EEF-CVE-2026-81643` · Hex `ash_graphql`: affected `>=1.4.0, <1.11.0`, fixed in `1.11.0` · CVSS 2.3 Low · Not analysed yet · Published 30 Aug 2026 · Tags: Broken access control
- [Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic](https://agentprime.io/advisories/GHSA-wm4m-cjmc-5v8c.md)
  `GHSA-wm4m-cjmc-5v8c`, `CVE-2026-82367`, `EEF-CVE-2026-82367` · Hex `ash_graphql`: affected `>=1.4.0, <1.11.0`, fixed in `1.11.0` · CVSS 2.3 Low · Not analysed yet · Published 30 Aug 2026 · Tags: CWE-488
- [Cloaked plaintext leaks through a non-sensitive action argument in AshCloak](https://agentprime.io/advisories/GHSA-qp4v-vvrg-8ggx.md)
  `GHSA-qp4v-vvrg-8ggx`, `CVE-2026-81322`, `EEF-CVE-2026-81322` · Hex `ash_cloak`: affected `>=0.1.0, <0.4.0`, fixed in `0.4.0` · CVSS 2.1 Low · Not analysed yet · Published 30 Aug 2026 · Tags: Information disclosure
- [Unsafe deserialization of decrypted terms enables node DoS in AshCloak](https://agentprime.io/advisories/GHSA-rc26-mrm2-6pf9.md)
  `GHSA-rc26-mrm2-6pf9`, `CVE-2026-81319`, `EEF-CVE-2026-81319` · Hex `ash_cloak`: affected `>=0.1.0, <0.4.0`, fixed in `0.4.0` · CVSS 5.9 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Insecure deserialization
- [rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres](https://agentprime.io/advisories/GHSA-6fqq-j9c4-5766.md)
  `GHSA-6fqq-j9c4-5766`, `CVE-2026-78699`, `EEF-CVE-2026-78699` · Hex `ash_postgres`: affected `>=0.25.0, <2.13.0`, fixed in `2.13.0` · CVSS 7.2 High · Not analysed yet · Published 30 Aug 2026 · Tags: CWE-252
- [exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql](https://agentprime.io/advisories/GHSA-8v9m-8pxv-738c.md)
  `GHSA-8v9m-8pxv-738c`, `CVE-2026-77454`, `EEF-CVE-2026-77454` · Hex `ash_sql`: affected `>=0.4.1, <0.7.1`, fixed in `0.7.1` · CVSS 5.9 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Broken access control
- [Same-named aggregates with differing filters are conflated in AshSql](https://agentprime.io/advisories/GHSA-v7pf-wjxc-7j5m.md)
  `GHSA-v7pf-wjxc-7j5m`, `CVE-2026-81316`, `EEF-CVE-2026-81316` · Hex `ash_sql`: affected `>=0.1.0, <0.7.1`, fixed in `0.7.1` · CVSS 2.1 Low · Not analysed yet · Published 30 Aug 2026 · Tags: Broken access control
- [Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql](https://agentprime.io/advisories/GHSA-ww8j-58rc-f8h3.md)
  `GHSA-ww8j-58rc-f8h3`, `CVE-2026-81318`, `EEF-CVE-2026-81318` · Hex `ash_sql`: affected `>=0.1.0, <0.7.1`, fixed in `0.7.1` · CVSS 2.1 Low · Not analysed yet · Published 30 Aug 2026 · Tags: Broken access control
- [Unescaped backslash allows LIKE wildcard injection in AshSql string search](https://agentprime.io/advisories/GHSA-5jgp-7mhc-6qqh.md)
  `GHSA-5jgp-7mhc-6qqh`, `CVE-2026-78691`, `EEF-CVE-2026-78691` · Hex `ash_sql`: affected `>=0.1.1-rc.10, <0.7.1`, fixed in `0.7.1` · CVSS 2.1 Low · Not analysed yet · Published 30 Aug 2026 · Tags: Other injection
- [SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql](https://agentprime.io/advisories/GHSA-76wx-w7ww-5xfq.md)
  `GHSA-76wx-w7ww-5xfq`, `CVE-2026-80227`, `EEF-CVE-2026-80227` · Hex `ash_sql`: affected `>=0.1.0, <0.7.1`, fixed in `0.7.1` · CVSS 2.1 Low · Not analysed yet · Published 30 Aug 2026 · Tags: CWE-697
- [Unbounded handle_error recursion enables denial of service in AshOban triggers](https://agentprime.io/advisories/GHSA-94p7-498r-mrhp.md)
  `GHSA-94p7-498r-mrhp`, `CVE-2026-78228`, `EEF-CVE-2026-78228` · Hex `ash_oban`: affected `>=0.8.0-rc.1, <0.8.14`, fixed in `0.8.14` · CVSS 5.9 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Denial of service
- [Job argument injection via :args overrides primary_key and tenant in AshOban](https://agentprime.io/advisories/GHSA-gj9p-x393-rf9h.md)
  `GHSA-gj9p-x393-rf9h`, `CVE-2026-78038`, `EEF-CVE-2026-78038` · Hex `ash_oban`: affected `>=0.2.5, <0.8.14`, fixed in `0.8.14` · CVSS 5.9 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Broken access control
- [JSON path injection via unescaped get_path segments in AshSqlite](https://agentprime.io/advisories/GHSA-hrp2-5hgw-c83c.md)
  `GHSA-hrp2-5hgw-c83c`, `CVE-2026-77846`, `EEF-CVE-2026-77846` · Hex `ash_sqlite`: affected `>=0.1.2-rc.0, <0.2.18`, fixed in `0.2.18` · CVSS 2.1 Low · Not analysed yet · Published 30 Aug 2026 · Tags: Other injection
- [Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc](https://agentprime.io/advisories/GHSA-533g-4vf3-xwrj.md)
  `GHSA-533g-4vf3-xwrj`, `CVE-2026-75759`, `EEF-CVE-2026-75759` · Hex `oidcc`: affected `>=3.2.0-beta.1, <3.9.0`, fixed in `3.9.0` · CVSS 7.6 High · Not analysed yet · Published 30 Aug 2026 · Tags: Weak cryptography or TLS
- [Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking](https://agentprime.io/advisories/GHSA-7c66-59m8-723c.md)
  `GHSA-7c66-59m8-723c`, `CVE-2026-77831`, `EEF-CVE-2026-77831` · Hex `ash_paper_trail`: affected `>=0.1.1, <0.7.0`, fixed in `0.7.0` · CVSS 2.1 Low · Not analysed yet · Published 30 Aug 2026 · Tags: Denial of service
- [Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions](https://agentprime.io/advisories/GHSA-v645-6jm6-cgpj.md)
  `GHSA-v645-6jm6-cgpj`, `CVE-2026-77970`, `EEF-CVE-2026-77970` · Hex `ash_paper_trail`: affected `>=0.3.0, <0.7.0`, fixed in `0.7.0` · CVSS 5.9 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Information disclosure
- [Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail](https://agentprime.io/advisories/GHSA-wqjr-xmxp-j554.md)
  `GHSA-wqjr-xmxp-j554`, `CVE-2026-75847`, `EEF-CVE-2026-75847` · Hex `ash_paper_trail`: affected `>=0.1.1, <0.7.0`, fixed in `0.7.0` · CVSS 5.9 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Information disclosure
- [Doggo vulnerable to cross-site scripting via unescaped date field values](https://agentprime.io/advisories/GHSA-w9rp-cf93-86pj.md)
  `GHSA-w9rp-cf93-86pj`, `CVE-2026-66353`, `EEF-CVE-2026-66353` · Hex `doggo`: affected `>=0.1.0, <0.14.8`, fixed in `0.14.8` · CVSS 5.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Cross-site scripting (XSS)
- [AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching](https://agentprime.io/advisories/GHSA-777c-2fxx-qr28.md)
  `GHSA-777c-2fxx-qr28`, `CVE-2026-49757`, `EEF-CVE-2026-49757` · Hex `ash_authentication`: affected `>=0.1.0, <4.14.0 || >=5.0.0-rc.0, <5.0.0-rc.10`, fixed in `4.14.0`, `5.0.0-rc.10` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [gRPC Erlang package has unbounded gzip decompression (decompression bomb)](https://agentprime.io/advisories/GHSA-6ccx-9c9f-327w.md)
  `GHSA-6ccx-9c9f-327w`, `CVE-2026-53430`, `EEF-CVE-2026-53430` · Hex `grpc`: affected `>=0.4.0, <1.0.0`, fixed in `1.0.0` · CVSS 8.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-409
- [Purpose-limited JWT accepted as full bearer authentication in AshAuthentication](https://agentprime.io/advisories/GHSA-6vcj-3h59-rrc3.md)
  `GHSA-6vcj-3h59-rrc3`, `CVE-2026-65633`, `EEF-CVE-2026-65633` · Hex `ash_authentication`: affected `>=3.10.5, <4.14.2 || >=5.0.0-rc.0, <5.0.0-rc.13`, fixed in `4.14.2`, `5.0.0-rc.13` · CVSS 7.6 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [Reflected XSS in AshAuthentication confirmation and magic link interaction forms](https://agentprime.io/advisories/GHSA-54fc-x3hv-ffhw.md)
  `GHSA-54fc-x3hv-ffhw`, `CVE-2026-66882`, `EEF-CVE-2026-66882` · Hex `ash_authentication`: affected `>=4.8.0, <4.14.2 || >=5.0.0-rc.0, <5.0.0-rc.13`, fixed in `4.14.2`, `5.0.0-rc.13` · CVSS 2.1 Low · Not analysed yet · Published 25 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Round-trip Corruption via Improper Entity Escaping in xml_builder](https://agentprime.io/advisories/GHSA-5hjx-8g53-cmvm.md)
  `GHSA-5hjx-8g53-cmvm`, `CVE-2026-47079`, `EEF-CVE-2026-47079` · Hex `xml_builder`: affected `>=0.0.6, <2.4.1`, fixed in `2.4.1` · CVSS 2.1 Low · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-838
- [Element and Attribute Names Injected Verbatim into XML Output in xml_builder](https://agentprime.io/advisories/GHSA-r82p-3q2p-728w.md)
  `GHSA-r82p-3q2p-728w`, `CVE-2026-48590`, `EEF-CVE-2026-48590` · Hex `xml_builder`: affected `>=0.0.1, <2.4.1`, fixed in `2.4.1` · CVSS 2.1 Low · Not analysed yet · Published 21 Aug 2026 · Tags: Other injection

Newest: <https://agentprime.io/advisories/ecosystem/hex.md>
Older: <https://agentprime.io/advisories/ecosystem/hex.md?cursor=WyIyMDI2LTA4LTIxVDA5OjUxOjI1LjQxMjAwMFoiLCJHSFNBLXI4MnAtM3EycC03Mjh3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Hex&cursor=WyIyMDI2LTA5LTAxVDAzOjM1OjE4LjU1MTAwMFoiLCJHSFNBLW1nd2otYzY5di02ZjgzIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/hex/?cursor=WyIyMDI2LTA5LTAxVDAzOjM1OjE4LjU1MTAwMFoiLCJHSFNBLW1nd2otYzY5di02ZjgzIl0>. Everything for agents: <https://agentprime.io/llms.txt>.