ash_typescript CVE-2026-82731

Exploitation requires three concurrent conditions: (1) the application must use ash_typescript 0.15.0-0.17.x and have regenerated TypeScript clients from it; (2) at least one route whose path begins with a parameter placeholder must be reachable - this is the configuration that enables the protocol-relative URL (//attacker.com) to form; (3) an attacker must be able to control or influence the value supplied as that leading path parameter in a real client invocation, either via a crafted link, injected data, or a manipulated UI flow, and the victim must trigger the client call. The query-string code path is immune (URLSearchParams.set encodes its input). Routes where no path segment is purely a parameter at the first position are still vulnerable to ../ path traversal and query-parameter smuggling (via ? and #) but not to the full protocol-relative credential-redirect attack.

The CVSS 4.0 base score of 2.3 (AV:N/AC:L/AT:P/PR:N/UI:P) correctly reflects two significant dampeners: AT:P acknowledges that credential exfiltration via the protocol-relative redirect requires a route whose first path segment is a parameter placeholder, which is a specific but not uncommon routing pattern; UI:P requires that a real user or automated integration invoke the generated client with an attacker-influenced parameter value. No KEV listing or public POC exists, and there is no EPSS data provided. Real-world risk is further constrained by ash_typescript's niche deployment footprint within the Elixir/Ash ecosystem - widespread exploitation is improbable. However, within affected applications the confidentiality impact is concrete: HTTP request headers (Bearer tokens, API keys, cookies forwarded by fetch) can be silently exfiltrated to an attacker host in a single interaction, with no visible browser warning for same-protocol requests. The integrity signal (VI:L in the provided vector) reflects the ability to redirect the request itself, bypassing the intended API endpoint.

An attacker who can influence what path-parameter value a victim application passes to the generated TypeScript client - for example, through a URL link, a stored value, or an API response - supplies /evil.example.com/x as the parameter. The route renderer interpolates this raw value into the URL template, producing the protocol-relative URL //evil.example.com/x. The fetch API resolves this against the page's current scheme (e.g., https:) and dispatches the credentialed request to https://evil.example.com/x, exfiltrating the Authorization header or other TypedControllerConfig credentials to the attacker's server. No public exploit code has been identified at time of analysis.