ash_ai EUVD-2026-68307

The attacker must be able to supply content that reaches the LLM model's input context - typically through user-facing text fields in an ash_ai-backed application that passes user content into the prompt. The model must then be persuaded via injected instructions to re-emit a tool_call_id already recorded in conversation history (triggering unprocessed_tool_calls/2 to drop it), or to emit a call with an unrecognized tool name (triggering normalize_tool_calls/2 to drop it), such that the combined filter yields an empty list. Exploitation is significantly more damaging when the application configures max_iterations: :infinity, which removes the only natural termination bound; a finite max_iterations value caps wasted iterations but does not prevent each triggering request from consuming the full budget. Low-privilege application access is required (PR:L per CVSS 4.0); unauthenticated anonymous exploitation is not indicated by available data. Applications that do not pass untrusted external content into LLM prompts are not practically exploitable via the prompt-injection vector.

The CVSS 4.0 score of 6.0 (AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) reflects a moderate real-world priority. Network accessibility (AV:N) and low privilege (PR:L) lower the exploitation bar, but AT:P - specific attack requirements - is the critical limiting factor: the attacker must successfully influence the LLM's output, typically via prompt injection in user-supplied data that the model processes. This is a meaningful but non-trivial barrier; applications that pass untrusted user content directly into LLM prompts are meaningfully exposed. Availability impact is high (VA:H) with no confidentiality or integrity exposure, making service disruption and unbounded LLM API cost accrual the primary business risks rather than data breach. The vulnerability is not listed in CISA KEV and no public exploit code was identified in the input data, consistent with a newly disclosed, niche-library issue. EPSS data was not provided; given the narrow deployment footprint and the prompt-injection prerequisite, real-world exploitation probability is estimated low. Risk is most acute in deployments configured with max_iterations: :infinity that accept untrusted user input into LLM prompts.

An attacker submits a message to an ash_ai-backed application containing prompt-injection instructions; the injected content causes the LLM to re-emit a tool_call_id already present in the session history. When unprocessed_tool_calls/2 filters out the spent ID, the resulting empty tool-call list triggers the no-progress recursion path, locking the ToolLoop worker and generating continuous, billable LLM API requests until the process is killed or an external resource limit is reached.