EUVD-2026-68328Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects compound preconditions (HTML injection sink, CSP allow-listing the published nonce, admin interaction required); no attacker authentication required.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.
When mounted without :csp_nonce_assign_key, AshAdmin.Router.ash_admin/2 defaulted the img, style, and script nonces to the literal constant ash_admin-Ed55GFnX, which AshAdmin.Layouts wrote verbatim into the nonce attribute of its inline <style> and <script> tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application's CSP script-src allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.
This issue affects ash_admin: from 0.10.8 before 1.3.1.
AnalysisAI
AshAdmin shipped a compile-time constant string ('ash_admin-Ed55GFnX') as the default CSP nonce for inline script and style tags across all requests in versions 0.10.8 through 1.3.0, rendering nonce-based Content-Security-Policy enforcement completely ineffective for any application using the default configuration. Applications that adopted the documented default and explicitly allow-listed this published constant in their CSP script-src directive would have their CSP protection neutralized by any attacker able to inject HTML into an admin page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions simultaneously: (1) ash_admin version 0.10.8 through 1.3.0 mounted without :csp_nonce_assign_key, so the constant 'ash_admin-Ed55GFnX' is emitted verbatim as the nonce attribute; (2) the host application's Content-Security-Policy explicitly allow-lists the nonce 'ash_admin-Ed55GFnX' in script-src or style-src - only deployments that followed the old documentation and embedded this constant in their CSP header are at risk; (3) an independent HTML injection sink exists on an admin-accessible page; and (4) an authenticated admin user actively visits the page containing the injected payload. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.1 accurately reflects a low-priority vulnerability that requires multiple conditions to be simultaneously true. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_admin to version 1.3.1 or later, which is confirmed by the vendor advisory GHSA-whfj-rrrp-j597 and the patch commit at https://github.com/ash-project/ash_admin/commit/bc7a1cdf873b16971a8efec35d085f8bb706314f. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored XSS in ash_admin's relationship typeahead components allows an attacker with low-privilege record-creation access
Arbitrary file write via path traversal in AshAdmin's file upload handler affects versions 0.13.7 through 1.3.0, enablin
Cookie shadowing via unanchored regex in AshAdmin (versions 0.9.1-1.3.0) allows an attacker who controls a sibling subdo
Atom table exhaustion in ash_admin's Phoenix LiveView event handlers allows any authenticated user reaching the admin in
Composite primary key decoding in AshAdmin (ash_admin) versions 0.1.0 through 1.3.0 can be abused by authenticated users
AshAdmin's Table, DataTable, and Show LiveView components constructed row-action URLs via raw Elixir string interpolatio
Same weakness CWE-330 – Use of Insufficiently Random Values
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today