AshAdmin CVE-2026-81852

Exploitation requires all of the following conditions simultaneously: (1) ash_admin version 0.10.8 through 1.3.0 mounted without :csp_nonce_assign_key, so the constant 'ash_admin-Ed55GFnX' is emitted verbatim as the nonce attribute; (2) the host application's Content-Security-Policy explicitly allow-lists the nonce 'ash_admin-Ed55GFnX' in script-src or style-src - only deployments that followed the old documentation and embedded this constant in their CSP header are at risk; (3) an independent HTML injection sink exists on an admin-accessible page; and (4) an authenticated admin user actively visits the page containing the injected payload. Applications that do not use a nonce-based CSP, that never referenced the published constant in their policy, that supply a custom :csp_nonce_assign_key, or that are running ash_admin 1.3.1 or later are not vulnerable.

The CVSS 4.0 score of 2.1 accurately reflects a low-priority vulnerability that requires multiple conditions to be simultaneously true. The AT:P (attack requirements present) metric captures that exploitation depends on an application using the default nonce configuration without :csp_nonce_assign_key, the host application's CSP explicitly allow-listing the published constant, and an independently exploitable HTML injection sink existing on the admin surface. The UI:A (active user interaction) metric further requires an authenticated admin to visit the affected page. There is no CISA KEV listing and no public exploit, making this a theoretical CSP bypass rather than an immediately actionable threat. The low VC:L and VI:L impact metrics reflect that successful exploitation enables inline script execution within the admin context but does not directly imply full account takeover or data exfiltration on its own. Real-world exposure is additionally bounded by ash_admin's niche deployment footprint within the Elixir ecosystem. Organizations running affected versions should include the upgrade to 1.3.1 in their next routine dependency update cycle; the compound conditions required mean emergency patching is not warranted unless the application is confirmed to simultaneously have an HTML injection vulnerability and a CSP that explicitly references the published constant.

An attacker who can inject HTML into an admin-facing resource view (via a separate stored-XSS or template injection vulnerability in a field rendered by AshAdmin) crafts a script element with nonce='ash_admin-Ed55GFnX'. When an authenticated admin visits the affected page, the browser validates the nonce against the CSP allow-list, finds a match due to the hardcoded constant, and executes the injected script - bypassing the CSP protection that was intended to block unauthorized inline scripts. No public proof-of-concept is known.