Hex Advisories.

Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion

• CWE-1287

>=2.14.18, <3.32.2 · fixed in 3.32.2

Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs

• CWE-20

>=2.16.1, <3.32.2 · fixed in 3.32.2

Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error

• Information disclosure

>=2.17.20, <3.32.2 · fixed in 3.32.2

Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service

• CWE-20

>=3.6.3, <3.32.2 · fixed in 3.32.2

Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads

• Memory corruption

>=2.14.13, <3.32.2 · fixed in 3.32.2

Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass

• CWE-180

>=1.29.0-rc0, <3.32.2 · fixed in 3.32.2

Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service

• Denial of service

>=0.10.0, <3.32.2 · fixed in 3.32.2

Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal

• CWE-1284

>=1.28.0, <3.32.2 · fixed in 3.32.2

Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection

• Open redirect

>=0.15.0, <0.18.0 · fixed in 0.18.0

Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter

• Denial of service

>=0.1.0, <0.18.0 · fixed in 0.18.0

Route handler return value echoed into AshTypescript error response

• Information disclosure

>=0.15.0, <0.18.0 · fixed in 0.18.0

Declared argument constraints not enforced on AshTypescript typed controller routes

• CWE-20

>=0.15.0, <0.18.0 · fixed in 0.18.0

Authorization-redacted field values disclosed through AshTypescript result normalization

• Broken access control

>=0.11.0, <0.18.0 · fixed in 0.18.0

RPC error handler fails open in AshTypescript, disclosing unredacted errors

• Information disclosure

>=0.8.0, <0.18.0 · fixed in 0.18.0

Unbounded atom creation from typed struct field names in AshTypescript field selector

• Denial of service

>=0.11.0, <0.18.0 · fixed in 0.18.0

AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data

• Broken access control

>=0.6.0-rc.1, <2.3.25 · fixed in 2.3.25

Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain

• Broken access control

>=2.1.26, <2.3.25 · fixed in 2.3.25

AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

• CWE-178
• CWE-625

>=2.1.26, <2.3.25 · fixed in 2.3.25

AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message

• Information disclosure

>=1.2.17, <2.3.25 · fixed in 2.3.25

Path traversal in AshAdmin file uploads via unsanitized client filename

• Path traversal

>=0.13.7, <1.3.1 · fixed in 1.3.1

AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle

• Broken access control

>=0.1.0, <1.3.1 · fixed in 1.3.1

AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

• Weak cryptography or TLS

>=0.10.8, <1.3.1 · fixed in 1.3.1

Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

• CWE-116

>=0.3.0-rc.0, <1.3.1 · fixed in 1.3.1

Stored XSS in AshAdmin relationship typeahead via unescaped label_field content

• Cross-site scripting (XSS)

>=0.13.0, <1.3.1 · fixed in 1.3.1

AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)

• Denial of service

>=0.1.0, <1.3.1 · fixed in 1.3.1

AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

• CWE-565

>=0.9.1, <1.3.1 · fixed in 1.3.1

AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error

• Information disclosure

>=0.1.0, <1.0.0 · fixed in 1.0.0

AshAi echoes raw tool exception messages into the conversation, disclosing internal details

• Information disclosure

>=0.6.0, <1.0.0 · fixed in 1.0.0

AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service

• Denial of service

>=0.6.0, <1.0.0 · fixed in 1.0.0

Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records

• Broken access control

>=0.6.0, <1.0.0 · fixed in 1.0.0

MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

• CWE-346

>=0.8.0, <1.0.0 · fixed in 1.0.0

EEx template evaluation of prompt content in AshAi enables remote code execution

• Code injection

>=0.1.0, <1.0.0 · fixed in 1.0.0

Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names

• Information disclosure

>=1.9.0, <1.11.0 · fixed in 1.11.0

Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read

• Broken access control

>=1.4.0, <1.11.0 · fixed in 1.11.0

Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

• Denial of service

>=0.16.23, <1.11.0 · fixed in 1.11.0

Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment

• CWE-20

>=0.27.0, <1.11.0 · fixed in 1.11.0

Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

• Broken access control

>=1.4.0, <1.11.0 · fixed in 1.11.0

Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic

• CWE-488

>=1.4.0, <1.11.0 · fixed in 1.11.0

Cloaked plaintext leaks through a non-sensitive action argument in AshCloak

• Information disclosure

>=0.1.0, <0.4.0 · fixed in 0.4.0

Unsafe deserialization of decrypted terms enables node DoS in AshCloak

• Insecure deserialization

>=0.1.0, <0.4.0 · fixed in 0.4.0

rename_tenant returns :ok on a failed rename, enabling cross-tenant access in AshPostgres

• CWE-252

>=0.25.0, <2.13.0 · fixed in 2.13.0

exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql

• Broken access control

>=0.4.1, <0.7.1 · fixed in 0.7.1

Same-named aggregates with differing filters are conflated in AshSql

• Broken access control

>=0.1.0, <0.7.1 · fixed in 0.7.1

Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql

• Broken access control

>=0.1.0, <0.7.1 · fixed in 0.7.1

Unescaped backslash allows LIKE wildcard injection in AshSql string search

• Other injection

>=0.1.1-rc.10, <0.7.1 · fixed in 0.7.1

SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql

• CWE-697

>=0.1.0, <0.7.1 · fixed in 0.7.1

Unbounded handle_error recursion enables denial of service in AshOban triggers

• Denial of service

>=0.8.0-rc.1, <0.8.14 · fixed in 0.8.14

Job argument injection via :args overrides primary_key and tenant in AshOban

• Broken access control

>=0.2.5, <0.8.14 · fixed in 0.8.14

JSON path injection via unescaped get_path segments in AshSqlite

• Other injection

>=0.1.2-rc.0, <0.2.18 · fixed in 0.2.18

Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

• Weak cryptography or TLS

>=3.2.0-beta.1, <3.9.0 · fixed in 3.9.0

Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking

• Denial of service

>=0.1.1, <0.7.0 · fixed in 0.7.0

Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions

• Information disclosure

>=0.3.0, <0.7.0 · fixed in 0.7.0

Sensitive attribute values stored in a non-sensitive public changes map in AshPaperTrail

• Information disclosure

>=0.1.1, <0.7.0 · fixed in 0.7.0

Doggo vulnerable to cross-site scripting via unescaped date field values

• Cross-site scripting (XSS)

>=0.1.0, <0.14.8 · fixed in 0.14.8

AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching

• Authentication bypass

>=0.1.0, <4.14.0 || >=5.0.0-rc.0, <5.0.0-rc.10 · fixed in 4.14.0, 5.0.0-rc.10

gRPC Erlang package has unbounded gzip decompression (decompression bomb)

• CWE-409

>=0.4.0, <1.0.0 · fixed in 1.0.0

Purpose-limited JWT accepted as full bearer authentication in AshAuthentication

• Authentication bypass

>=3.10.5, <4.14.2 || >=5.0.0-rc.0, <5.0.0-rc.13 · fixed in 4.14.2, 5.0.0-rc.13

Reflected XSS in AshAuthentication confirmation and magic link interaction forms

• Cross-site scripting (XSS)

>=4.8.0, <4.14.2 || >=5.0.0-rc.0, <5.0.0-rc.13 · fixed in 4.14.2, 5.0.0-rc.13

Round-trip Corruption via Improper Entity Escaping in xml_builder

• CWE-838

>=0.0.6, <2.4.1 · fixed in 2.4.1

Element and Attribute Names Injected Verbatim into XML Output in xml_builder

• Other injection

>=0.0.1, <2.4.1 · fixed in 2.4.1