ash_sql CVE-2026-80227

The target application must run ash_sql version 0.1.0 through 0.7.0. The string_trim/1 function must be explicitly used within an Ash resource definition - in a filter, uniqueness identity block, or changeset validation - and that expression must be evaluated at the SQL layer (the default for database-backed queries). The attacker must be able to submit string input containing at least one of: horizontal tab (U+0009), line feed (U+000A), carriage return (U+000D), or form feed (U+000C). Applications that do not reference string_trim/1 in their Ash data layer are entirely unaffected, as are those relying solely on database-native UNIQUE constraints independent of the ash_sql trimming logic.

The CVSS 4.0 score of 2.1 with vector AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L reflects a narrow, conditions-dependent integrity issue. AT:P correctly captures that the vulnerable code path must be active - specifically, string_trim/1 must appear in the application's Ash data layer. The impact is limited to low integrity (VI:L); there is no confidentiality or availability consequence. No EPSS score, CISA KEV listing, or public exploit code is present in the available intelligence, all of which are consistent with a low-risk finding in a niche ecosystem. The 'Information Disclosure' tag present in source metadata conflicts with the CVSS impact metrics (VC:N) and appears to be mislabeled. Real-world risk is application-specific: deployments that use string_trim/1 in uniqueness identities or equality filters face a data-integrity bypass; those that do not are entirely unaffected. Given the small affected ecosystem, low severity, absence of public exploit, and availability of a straightforward patch, this is a low-priority remediation target for most teams.

An attacker submitting a user-registration form could enter a username such as 'admin' with a trailing tab character; the SQL REGEXP_REPLACE pattern strips only spaces and so the database treats the padded value as distinct from the existing 'admin' record, allowing the near-duplicate to be inserted and bypassing the uniqueness identity. Elixir's in-memory evaluation would consider them equal, creating an inconsistency that could be leveraged to impersonate or shadow an existing account. No public exploit code has been identified at time of analysis.