Read the docs
TI-2026-54250 Aliases CVE-2026-77950

RPC error handler fails open in AshTypescript, disclosing unredacted errors

Priority MEDIUM 61CWE-209Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-209.

Summary

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. apply_error_handler/3 in lib/ash_typescript/rpc/errors.ex is the only hook an application has for redacting or suppressing errors before they reach the client, with a nil return dropping the error entirely. Its rescue clause logs a warning and then returns the original, pre-handler error map. Error handlers are conventionally written as pattern-matching functions over expected error shapes, so an unmatched shape raises FunctionClauseError and the raw transformed error, including any secrets carried in vars, is emitted instead. An intent to suppress an error becomes an intent to publish it. The rescue catches exceptions only, so a handler that throws or exits still propagates. This issue affects ash_typescript: from 0.8.0 before 0.18.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00547 46th percentileScored 2026-11-07
Fix Fixed ash_typescript (ash-project): 0.18.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ash-projectash_typescript0.8.0 to before 0.18.00.18.0Patch availableCNA
  • ash_typescript Vendorash-project Affected 0.8.0 to before 0.18.0 Fixed in 0.18.0 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA ash_typescript (ash-project) Fixed in 0.18.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ash-project ash_typescript 0.18.0

    7 records Highest priority Priority HIGH 3 HIGH, 4 MEDIUM

    Other records, highest priority first

    • TI-2026-52572 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatterPriority HIGH 77
    • TI-2026-57048 Authorization-redacted field values disclosed through AshTypescript result normalizationPriority HIGH 69
    • TI-2026-54210 Unbounded atom creation from typed struct field names in AshTypescript field selectorPriority HIGH 69
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77950

References

Patch 1

Advisory 1

Other 2

  • TI-2026-56298 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service CVSS 4.0HIGH 8.7
  • TI-2026-52572 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter CVSS 4.0HIGH 8.7
  • TI-2026-57010 Path traversal in AshAdmin file uploads via unsanitized client filename CVSS 4.0HIGH 8.3
  • TI-2026-26840 Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash CVSS 4.0HIGH 8.2
  • TI-2026-54252 EEx template evaluation of prompt content in AshAi enables remote code execution CVSS 4.0HIGH 8.9
  • TI-2026-54208 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content CVSS 4.0HIGH 8.4
See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences