Ash Ai
Monthly
Credential leakage in ash_ai (versions 0.1.0 through before 1.0.0) exposes embedding provider API keys and request internals to authenticated API callers via unsanitized error messages. In AshAi.Changes.Vectorize, a failed embedding provider call caused the raw Elixir error struct - which HTTP clients commonly populate with the outbound Authorization header, request URL, and provider response body - to be passed through inspect/1 directly into a user-facing changeset error. AshJsonApi and AshGraphql serialize these changeset errors into API responses, making the full credential material readable by any caller who can trigger a provider failure. No public exploit has been identified at time of analysis, but the trigger condition (oversized or malformed vectorized content) is trivially reachable by any authenticated user of an exposed endpoint.
Unfiltered exception serialization in ash_ai 0.6.0-0.x leaks internal application details - database schema, raw SQL fragments, policy module names - to authenticated chat users via the LLM conversation stream. AshAi.ToolLoop and AshAi.Tools used Elixir's Exception.message/1 verbatim to encode any raised tool exception into the tool-result payload, which the language model then relayed to the requesting user. Any authenticated user able to steer tool arguments into a code path that raises an exception could extract sensitive internal reconnaissance data; ash_ai 1.0.0 closes the gap by routing all tool exceptions through a safe formatter. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Infinite-loop denial-of-service in ash_ai's ToolLoop component (versions 0.6.0 through <1.0.0) allows an attacker who can influence LLM model output - most practically via prompt injection - to hang the agent loop indefinitely and drive unbounded, repeated model API requests. When the LLM returns tool_call_ids that are either invalid or already present in the session history, the post-filter call list empties, yet the loop recurses with a byte-identical message state, making no forward progress and wasting unbounded API budget. No public exploit code or active exploitation has been identified at time of analysis; however, the prompt-injection attack path is well within reach of applications that ingest untrusted user content.
Authorization bypass in AshAi (ash_ai) versions 0.6.0 through pre-1.0.0 allows any authenticated tool caller to update or destroy database records it never legitimately identified, up to and including every row in a table. The flaw is in AshAi.Tool.Execution.identity_filter/3, which passes raw tool arguments directly into Ash.Query.do_filter/2; because Ash's filter DSL interprets map values as predicate expressions rather than scalar literals, a caller can inject filter logic such as {"not_eq": "<own-ref>"} to retarget bulk writes to arbitrary records. A vendor patch is available in commit 87f616d and the fix version is 1.0.0; no public exploit or CISA KEV listing exists at time of analysis.
DNS-rebinding protection in AshAi.Mcp.Server (ash_ai 0.8.0-0.x) is bypassable because the default origin check trusts the attacker-controlled Host and X-Forwarded-Proto headers as proxies for TLS context. A malicious web page can exploit this to issue arbitrary cross-site requests to the victim's locally running MCP server, executing MCP calls under the victim's actor credentials. No public exploit has been identified at time of analysis, but the attack path is mechanically straightforward for any attacker who can lure a developer to a malicious page while they have the MCP server running locally.
Remote code execution in ash_ai (versions 0.1.0 through pre-1.0.0) allows unauthenticated network attackers to execute arbitrary Elixir code on the server by submitting EEx template payloads through prompt action arguments. The AshAi.Actions.Prompt module incorrectly passed function-supplied prompt content - which is frequently assembled from user-controlled action arguments - through EEx.eval_string/2 before forwarding to the AI model, meaning payloads like <%= System.cmd("id", []) %> execute server-side with application process privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-authentication, single-request exploitation path gives this a higher operational priority than the EPSS percentile alone suggests.
Credential leakage in ash_ai (versions 0.1.0 through before 1.0.0) exposes embedding provider API keys and request internals to authenticated API callers via unsanitized error messages. In AshAi.Changes.Vectorize, a failed embedding provider call caused the raw Elixir error struct - which HTTP clients commonly populate with the outbound Authorization header, request URL, and provider response body - to be passed through inspect/1 directly into a user-facing changeset error. AshJsonApi and AshGraphql serialize these changeset errors into API responses, making the full credential material readable by any caller who can trigger a provider failure. No public exploit has been identified at time of analysis, but the trigger condition (oversized or malformed vectorized content) is trivially reachable by any authenticated user of an exposed endpoint.
Unfiltered exception serialization in ash_ai 0.6.0-0.x leaks internal application details - database schema, raw SQL fragments, policy module names - to authenticated chat users via the LLM conversation stream. AshAi.ToolLoop and AshAi.Tools used Elixir's Exception.message/1 verbatim to encode any raised tool exception into the tool-result payload, which the language model then relayed to the requesting user. Any authenticated user able to steer tool arguments into a code path that raises an exception could extract sensitive internal reconnaissance data; ash_ai 1.0.0 closes the gap by routing all tool exceptions through a safe formatter. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Infinite-loop denial-of-service in ash_ai's ToolLoop component (versions 0.6.0 through <1.0.0) allows an attacker who can influence LLM model output - most practically via prompt injection - to hang the agent loop indefinitely and drive unbounded, repeated model API requests. When the LLM returns tool_call_ids that are either invalid or already present in the session history, the post-filter call list empties, yet the loop recurses with a byte-identical message state, making no forward progress and wasting unbounded API budget. No public exploit code or active exploitation has been identified at time of analysis; however, the prompt-injection attack path is well within reach of applications that ingest untrusted user content.
Authorization bypass in AshAi (ash_ai) versions 0.6.0 through pre-1.0.0 allows any authenticated tool caller to update or destroy database records it never legitimately identified, up to and including every row in a table. The flaw is in AshAi.Tool.Execution.identity_filter/3, which passes raw tool arguments directly into Ash.Query.do_filter/2; because Ash's filter DSL interprets map values as predicate expressions rather than scalar literals, a caller can inject filter logic such as {"not_eq": "<own-ref>"} to retarget bulk writes to arbitrary records. A vendor patch is available in commit 87f616d and the fix version is 1.0.0; no public exploit or CISA KEV listing exists at time of analysis.
DNS-rebinding protection in AshAi.Mcp.Server (ash_ai 0.8.0-0.x) is bypassable because the default origin check trusts the attacker-controlled Host and X-Forwarded-Proto headers as proxies for TLS context. A malicious web page can exploit this to issue arbitrary cross-site requests to the victim's locally running MCP server, executing MCP calls under the victim's actor credentials. No public exploit has been identified at time of analysis, but the attack path is mechanically straightforward for any attacker who can lure a developer to a malicious page while they have the MCP server running locally.
Remote code execution in ash_ai (versions 0.1.0 through pre-1.0.0) allows unauthenticated network attackers to execute arbitrary Elixir code on the server by submitting EEx template payloads through prompt action arguments. The AshAi.Actions.Prompt module incorrectly passed function-supplied prompt content - which is frequently assembled from user-controlled action arguments - through EEx.eval_string/2 before forwarding to the AI model, meaning payloads like <%= System.cmd("id", []) %> execute server-side with application process privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-authentication, single-request exploitation path gives this a higher operational priority than the EPSS percentile alone suggests.