EUVD-2026-68925Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because success depends on application-specific partial handler coverage gaps entirely outside attacker control; C:L bounds leakage to error var contents.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
2DescriptionCVE.org
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match.
apply_error_handler/3 in lib/ash_typescript/rpc/errors.ex is the only hook an application has for redacting or suppressing errors before they reach the client, with a nil return dropping the error entirely. Its rescue clause logs a warning and then returns the original, pre-handler error map. Error handlers are conventionally written as pattern-matching functions over expected error shapes, so an unmatched shape raises FunctionClauseError and the raw transformed error, including any secrets carried in vars, is emitted instead. An intent to suppress an error becomes an intent to publish it. The rescue catches exceptions only, so a handler that throws or exits still propagates.
This issue affects ash_typescript: from 0.8.0 before 0.18.0.
AnalysisAI
Sensitive internal error data - including runtime secrets potentially carried in Ash error vars fields - leaks to unauthenticated network clients in ash_typescript 0.8.0 through 0.17.x when a configured error handler raises a FunctionClauseError on an unmatched error shape. The rescue clause in apply_error_handler/3 was intended as a safety net but fell back to returning the original, unredacted error map rather than a safe generic response, inverting the intended suppress-on-failure semantics. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific conditions to be simultaneously true: first, the application must have configured a custom error_handler in its Ash domain typescript_rpc block - applications using only the default error path are not affected; second, that handler must be a partial pattern-matching function that does not cover the specific Ash error shape triggered by the attacker's request. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.3 with AT:P accurately captures that exploitation is conditional: the application must have a custom error handler that does not cover all possible Ash error shapes, which is the common but not universal Elixir pattern-matching idiom. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_typescript to version 0.18.0 or later, which replaces the fail-open rescue clause with the fail-closed generic_internal_error/2 path; the patch commit is https://github.com/ash-project/ash_typescript/commit/59d8e985a98cf2e01794dbe5b919b897a95311f4 and the vendor advisory is at https://github.com/ash-project/ash_typescript/security/advisories/GHSA-mjr7-r3rf-x963. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ash Typescript
View allUnauthenticated atom table exhaustion in ash_typescript 0.1.0-0.17.x allows any network attacker to crash the entire Erl
Unauthenticated BEAM atom table exhaustion in ash_typescript 0.11.0-0.17.x allows a remote attacker to abort the Erlang
Field policy enforcement in ash_typescript RPC serialization is bypassed by a missing pattern-match clause, allowing una
Constraint bypass in ash_typescript typed-controller routes allows remote attackers to submit argument values outside de
Sensitive application data leaks from HTTP 500 responses in ash_typescript versions 0.15.0 through 0.17.x due to an unga
Open redirect in ash_typescript's TypeScript client code generator allows an attacker who controls a path-parameter valu
Same weakness CWE-209 – Error Message Information Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today