Ash Lua
Monthly
Sensitive field disclosure in ash_lua (versions 0.1.0 through 0.2.0) allows any actor who can submit a Lua script to read Ash resource attributes that are deliberately excluded from the manifest's exposed-field allow-list - including sensitive?: true columns such as hashed passwords. The operation aggregate path in AshLua.Runtime resolved field names directly via String.to_existing_atom and Ash.Query.Aggregate.new! without invoking the same AshLua.Fields.for_action/4 allow-list check enforced by the normal field-read path, creating an alternate route to private data. Vendor patch 0.2.1 is confirmed available; no CISA KEV listing or independent exploit beyond the PoC embedded in the security advisory has been identified.
Field policy bypass in AshLua 0.1.0-0.2.1 allows authenticated Lua script executors to read actor-restricted fields by requesting them through aggregate operations (min, max, first, sum, avg, list) rather than as direct record fields, circumventing per-actor field policy authorization while remaining within the configured exposed-field allow-list. The Ash framework normally redacts forbidden fields on returned record structs with %Ash.ForbiddenField{}, but AshLua's read action did not apply this check when constructing ad-hoc Ash.Query.Aggregate instances, returning raw field values instead. No public exploit code exists and the vulnerability is not in CISA KEV; the CVSS 4.0 score of 6.0 reflects network-accessible but prerequisite-gated exploitation requiring authenticated script execution access.
Sensitive field disclosure in ash_lua (versions 0.1.0 through 0.2.0) allows any actor who can submit a Lua script to read Ash resource attributes that are deliberately excluded from the manifest's exposed-field allow-list - including sensitive?: true columns such as hashed passwords. The operation aggregate path in AshLua.Runtime resolved field names directly via String.to_existing_atom and Ash.Query.Aggregate.new! without invoking the same AshLua.Fields.for_action/4 allow-list check enforced by the normal field-read path, creating an alternate route to private data. Vendor patch 0.2.1 is confirmed available; no CISA KEV listing or independent exploit beyond the PoC embedded in the security advisory has been identified.
Field policy bypass in AshLua 0.1.0-0.2.1 allows authenticated Lua script executors to read actor-restricted fields by requesting them through aggregate operations (min, max, first, sum, avg, list) rather than as direct record fields, circumventing per-actor field policy authorization while remaining within the configured exposed-field allow-list. The Ash framework normally redacts forbidden fields on returned record structs with %Ash.ForbiddenField{}, but AshLua's read action did not apply this check when constructing ad-hoc Ash.Query.Aggregate instances, returning raw field values instead. No public exploit code exists and the vulnerability is not in CISA KEV; the CVSS 4.0 score of 6.0 reflects network-accessible but prerequisite-gated exploitation requiring authenticated script execution access.