Ash Framework CVE-2026-67579

Ash Framework is an Elixir declarative resource and data layer abstraction used with AshPostgres, Ash.DataLayer.Ets, and Ash.DataLayer.Simple. The vulnerable code resides in decode_values/2 within lib/ash/page/keyset.ex, which decodes client-supplied keyset pagination cursors using Erlang's non_executable_binary_to_term/2 with the [:safe] option. The [:safe] flag prevents deserialization of new atoms, anonymous functions, and ports, but does not block reconstruction of structs whose atom keys are already present in the BEAM VM's atom table at runtime. Because Ash loads its own expression struct modules (including %Ash.Query.Call{}) at startup, those atoms are already interned, and a term_to_binary-serialized %Ash.Query.Call{} survives the [:safe] guard intact. The reconstructed struct is then passed to do_filters/4, which splices it into the keyset comparison filter as a value - a code path that never invokes the Ash.Expr macro's private?/public? access gate. On AshPostgres, the injected fragment is inlined directly into the Ecto SQL query (CWE-89 SQL Injection); on ETS and Simple layers, the expression is evaluated in-process as an arbitrary function call (CWE-502 Deserialization of Untrusted Data). The patch adds check_no_expression/1, which calls Ash.Expr.expr?/1 on the decoded term and returns {:error, %Ash.Error.Page.InvalidKeyset{}} for any expression-containing cursor.