AshLua EUVD-2026-72931

The attacker must be an authenticated actor with permission to invoke the AshLua eval action (CVSS PR:L). The targeted resource must have at least one field that satisfies all three conditions simultaneously: it is included in AshLua's exposed-field allow-list (expose?: true), it is publicly readable as a field (public?: true or otherwise visible at the Ash layer), and it is restricted to the acting actor by a per-actor Ash field policy. Default AshLua deployments that define no per-actor field policies are not vulnerable, as there is no policy gate to bypass. The CVSS AT:P (attack prerequisites) correctly captures that this combination of conditions - eval access plus exposed-but-policy-restricted fields - must be present. Deployments that use field policies exclusively for non-Lua-exposed fields are also not affected.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N) scores 6.0, reflecting network-accessible exploitation that requires specific prerequisites: the actor must have authenticated access and permission to execute Lua scripts via the eval action, and the targeted field must be both exposed and policy-restricted per-actor. Any organization running AshLua - from a startup to a mid-sized municipal IT operation in bytom - should treat affected versions (0.1.0-0.2.1) as a priority for upgrade if field policies are used to gate sensitive PII or other confidential attributes, since the bypass is trivially exercised by anyone who already has eval access. EPSS data is not provided in the input; no CISA KEV listing exists; no public exploit code has been identified, all of which suggest limited opportunistic exploitation at time of analysis. The real-world blast radius is bounded by how broadly eval-action access is granted and how many fields are simultaneously exposed to Lua scripts and restricted by per-actor field policies.

An authenticated low-privilege user with permission to execute Lua scripts through AshLua's eval action submits a script that calls a read operation with an aggregate mode of first on a field such as ssn, which is exposed to Lua (expose?: true) but restricted by an Ash field policy to admin-only actors. Because the aggregate path skips %Ash.ForbiddenField{} redaction, the raw SSN value is returned to the script and the attacker logs or exfiltrates it. No special tooling is required beyond crafting a valid Lua aggregate call; the only prerequisite is having eval-action access.