ash_ai EUVD-2026-68308

The attacker must hold an authenticated session with access to the AI chat interface (CVSS PR:L). The ash_ai deployment must be running a version in the range 0.6.0 to below 1.0.0. At least one registered tool callback or Ash lifecycle hook must be capable of raising an exception whose Exception.message/1 output contains sensitive internal text - most commonly when callbacks interact with Ecto (producing SQL and schema details in errors), invoke Ash authorization policies (embedding policy module names), or call adapters that surface diagnostic context in exceptions. The attacker must be able to steer tool input arguments into the raising code path, which typically requires knowing or discovering valid tool names and parameter schemas exposed by the application. This vulnerability does not affect ash_ai deployments that do not expose tool-calling functionality to end users, or where the chat interface is restricted to fully privileged internal operators with no information-disclosure risk. No special network position, exploit payload, or prior system access beyond an authenticated chat session is required.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) accurately characterizes a moderate, network-accessible information-disclosure risk: no special attack conditions are required beyond holding authenticated access to the chat interface. EPSS data was not provided in the input, so no empirical exploitation-probability estimate is available; likelihood is therefore inferred from CVSS metrics alone. The CVE is not in CISA KEV and no public POC repository has been identified, meaning no confirmed active exploitation or weaponized exploit code is known at time of analysis. The practical impact ceiling is bounded: successful exploitation yields partial internal reconnaissance (schema, SQL, policy names) rather than credentials, tokens, or full data extraction. The exploitability is constrained by the requirement for an authenticated session and the need to identify a tool invocation that can be steered into a raising code path - opportunistic automated exploitation is unlikely. Integrity and availability impacts do not apply. The CVSS score is consistent with the description; no conflicting signals were observed in the available data.

An authenticated user of an ash_ai-powered chat application identifies a database search or resource-query tool and submits arguments crafted to trigger an Ecto constraint violation - for example, referencing a non-existent column or violating a unique index. The tool callback raises an Ecto exception whose message includes the raw SQL and internal table name (e.g., 'column "password_hash" does not exist. query: SELECT ... FROM "internal"."users"'); Exception.message/1 serializes this verbatim into the JSON tool result, which the model relays to the user. The attacker now holds schema and table-name intelligence suitable for reconnaissance of further SQL injection or privilege escalation paths. No public exploit code has been identified.