hex ash vulnerabilities

Latest hex ash CVEs

Newest publication first

1. CVE-2026-55736 Private action arguments can be set by user input in Ash

   Published 2026-06-23

   Medium·CVSS 5.9 EPSS 0.22%

   Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash allows a user to set the value of a private action argument that is intended to be controlled only by trusted server-side code. Action arguments declared with public?:...

2. CVE-2026-34593 Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash

   Published 2026-04-02

   High·CVSS 8.2 EPSS 0.44%

   Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type.Module.cast_input/2 unconditionally creates a new Erlang atom via Module.concat([value]) for any user-supplied binary string that starts with "Elixir.", before...

3. CVE-2025-48044 Authorization bypass when bypass policy condition evaluates to true

   Published 2025-10-17

   High·CVSS 8.6 EPSS 0.68%

   Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This issue affects ash: from 3.6.3 before 3.7.1.

4. CVE-2025-48043 Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization

   Published 2025-10-10

   High·CVSS 8.6 EPSS 0.40%

   Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This issue affects ash: from 0.1.1 before 3.6.2.

5. CVE-2025-48042 Before action hooks may execute in certain scenarios despite a request being forbidden

   Published 2025-09-07

   High·CVSS 7.1 EPSS 0.35%

   Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ash: from 0.1.1 before 3.5.39.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.