ash_typescript CVE-2026-82733

Exploitation requires that at least one typed-controller route handler in the target application returns a value other than %Plug.Conn{} - for example, an error tuple such as {:error, %SomeStruct{}} or a bare map or atom. This condition arises from application-layer coding patterns (incomplete handlers, error-branch fallthrough) and is not attacker-controllable unless the attacker can also influence handler logic through request inputs. The CVSS AT:P (Attack Requirements: Present) formally encodes this precondition. Exploitation is further scoped to ash_typescript versions 0.15.0-0.17.x and only affects routes processed by the TypedController request handler. No authentication is required (PR:N) and no user interaction is needed (UI:N). Applications where all typed-controller handlers are guaranteed to return a %Plug.Conn{} on every code path - including error branches - are not exploitable regardless of version.

The CVSS 4.0 score of 6.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) reflects two competing signals: network-reachable with no privileges or user interaction required (PR:N, AV:N), but AT:P (Attack Requirements: Present) indicating a deployment-specific precondition - a route handler must return a non-conn value. This precondition is outside attacker control and is the primary risk limiter. Applications whose handlers always return a %Plug.Conn{} are not exploitable regardless of version. The confidentiality impact is rated Low in CVSS 4.0 terms, though practically the exposed data (hashed passwords, tokens) can be high-value depending on the application's domain model. No CISA KEV listing and no public exploit code identified; the vulnerability is not confirmed as actively exploited. Real-world risk is meaningful for applications in rapid development or those with error-handling branches that return error tuples to typed-controller dispatch, and negligible for applications with complete handler coverage.

An unauthenticated attacker sends an HTTP request to a typed-controller endpoint whose handler returns {:error, %User{hashed_password: "$2b$12$...", token: "...", tenant_id: "..."}} rather than a %Plug.Conn{}. The unpatched dispatch/3 calls unexpected_return/2, which serializes the full struct via inspect/2 and embeds it in the JSON 500 response body; the attacker reads the hashed password and session token directly from the response with no further steps required.