EUVD-2026-68326Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS escalating attacker's limited session to full admin context constitutes scope change (S:C); PR:L reflects required record-creation access; UI:R for the admin's typeahead interaction.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser.
The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in <b> tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record's label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as <img src=x onerror=...> runs as JavaScript in the admin's session as soon as a matching record appears in the dropdown, giving the attacker the admin's privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.
This issue affects ash_admin: from 0.13.0 before 1.3.1.
AnalysisAI
Stored XSS in ash_admin's relationship typeahead components allows an attacker with low-privilege record-creation access to execute arbitrary JavaScript in an administrator's browser. Affected are ash_admin versions 0.13.0 through 1.3.1, where the RelationshipField and ManagedRelationshipSelectField components render database record label fields unescaped via Phoenix.HTML.raw/1 after applying search-term highlight markup. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites must be met: (1) the attacker holds write access to create or modify records in a resource configured as a relationship target within AshAdmin - this is the PR:L condition in the CVSS 4.0 vector, meaning any application-level account with record-creation rights qualifies; and (2) an administrator actively uses the AshAdmin relationship typeahead and the malicious record appears in the search results - the UI:A condition requiring the admin to perform an action rather than merely load a page. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.4 (High) accurately captures the primary risk signals: network-reachable (AV:N), low complexity (AC:L), low privilege required (PR:L - any user able to create records), and active admin interaction needed (UI:A). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_admin to version 1.3.1 or later, which contains the fix introduced in commit 07289191ccdac27dd70ab7c6413ed057bc7fdade; the vendor advisory is at https://github.com/ash-project/ash_admin/security/advisories/GHSA-m23x-576h-73w8. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary file write via path traversal in AshAdmin's file upload handler affects versions 0.13.7 through 1.3.0, enablin
Cookie shadowing via unanchored regex in AshAdmin (versions 0.9.1-1.3.0) allows an attacker who controls a sibling subdo
Atom table exhaustion in ash_admin's Phoenix LiveView event handlers allows any authenticated user reaching the admin in
Composite primary key decoding in AshAdmin (ash_admin) versions 0.1.0 through 1.3.0 can be abused by authenticated users
AshAdmin shipped a compile-time constant string ('ash_admin-Ed55GFnX') as the default CSP nonce for inline script and st
AshAdmin's Table, DataTable, and Show LiveView components constructed row-action URLs via raw Elixir string interpolatio
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today