TI-2026-57058 Aliases CVE-2026-82740

Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs

MEDIUM 44CWE-20Published 2026-09-01 · Updated 2026-09-01

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper Input Validation vulnerability in ash-project ash fails to enforce the outer array constraints on a doubly-nested {:array, {:array, type}} attribute, letting invalid input pass validation. Ash.Type.apply_constraints/3 (lib/ash/type/type.ex) handled the {:array, {:array, type}} case by mapping only the inner {:array, type} constraints over each element, so constraints declared on the outer array (such as min_length, max_length, and nil_items?) were never applied. An attacker could submit an outer list that violates those constraints (too many elements, or nil entries where disallowed) and have it accepted and persisted. The fix enforces the outer array constraints and adds explicit handling for nil and non-list inputs. This issue affects ash: from 2.16.1 before 3.32.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0018 7th percentileScored 2026-11-07

Fix Fixed ash (ash-project): 3.32.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ash-project	ash	2.16.1 to before 3.32.2	3.32.2	Patch available	CNA

ash Vendorash-project Affected 2.16.1 to before 3.32.2 Fixed in 3.32.2 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ash-project:ash::::::::	—	—	—

cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA ash (ash-project) Fixed in 3.32.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-01
ash-project ash 3.32.2
16 records Highest priority Priority MEDIUM 15 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2026-57067 Incorrect authorization in ash-project ashPriority MEDIUM 60
- TI-2026-57065 Ash.Policy.Authorizer returns records denied by a runtime read policy to any actorPriority MEDIUM 60
- TI-2026-57064 Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden recordsPriority MEDIUM 60
Show all 16 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-82740

References

Patch 1

https://github.com/ash-project/ash/commit/c85ccff7dc6e3b0b3e40ad788b0056b3b6bee5ce

Advisory 1

https://github.com/ash-project/ash/security/advisories/GHSA-v29m-p28g-w5fc

Other 2

TI-2026-56298 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service CVSS 4.0HIGH 8.7
TI-2026-52572 Unbounded atom creation from client-supplied RPC field names in AshTypescript field formatter CVSS 4.0HIGH 8.7
TI-2026-57010 Path traversal in AshAdmin file uploads via unsanitized client filename CVSS 4.0HIGH 8.3
TI-2026-26840 Ash Framework: Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash CVSS 4.0HIGH 8.2
TI-2026-54252 EEx template evaluation of prompt content in AshAi enables remote code execution CVSS 4.0HIGH 8.9
TI-2026-54208 Stored XSS in AshAdmin relationship typeahead via unescaped label_field content CVSS 4.0HIGH 8.4

See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences