Ash Paper Trail
Monthly
Cubic-complexity denial of service in ash_paper_trail's full-diff list change builder allows any user permitted to invoke a paper-trailed Ash action with an accepted array attribute to exhaust backend CPU and memory. Versions 0.1.1 through 0.6.x are affected; the root cause is an O(n³) list accumulation pattern in `AshPaperTrail.ChangeBuilders.FullDiff.ListChange` where unbounded action input directly drives allocation. No public exploit has been identified and the issue is not in CISA KEV, but no rate-limiting or length check guards the vulnerable path, making the attack trivially reproducible by any user with action access.
Cleartext exposure of nested sensitive fields in Ash Paper Trail audit logs (versions 0.3.0-0.6.x) allows any principal with read access to the version resource table to recover credentials, tokens, or other sensitive values stored inside embedded resources, union types, or lists. The redaction logic in `maybe_redact_changes/3` and `AshPaperTrail.Resource.Changes.CreateNewVersion` only inspects top-level resource attributes for the `sensitive?` flag, never recursing into nested structures, so a parent attribute that is not itself marked sensitive silently passes its embedded sensitive children through to the version table in cleartext. No public exploit has been identified and the issue is not listed in CISA KEV; a vendor-released patch is available at version 0.7.0.
Cleartext storage of sensitive Ash resource attributes in AshPaperTrail versions 0.1.1 through 0.6.x allows any actor with read access to the generated version resource to recover plaintext values of fields marked `sensitive? true`. The library's `CreateVersionResource` transformer incorrectly derives the sensitivity flag for the `changes` map from the `ignore_attributes` exclusion list rather than from the actual tracked attributes, causing the map to always be declared `sensitive? false` and `public? true`, which bypasses Ash's built-in redaction and exposes sensitive values in API responses, logs, and inspect output. No public exploit is identified and no active exploitation is confirmed; a vendor patch was released in version 0.7.0.
Cubic-complexity denial of service in ash_paper_trail's full-diff list change builder allows any user permitted to invoke a paper-trailed Ash action with an accepted array attribute to exhaust backend CPU and memory. Versions 0.1.1 through 0.6.x are affected; the root cause is an O(n³) list accumulation pattern in `AshPaperTrail.ChangeBuilders.FullDiff.ListChange` where unbounded action input directly drives allocation. No public exploit has been identified and the issue is not in CISA KEV, but no rate-limiting or length check guards the vulnerable path, making the attack trivially reproducible by any user with action access.
Cleartext exposure of nested sensitive fields in Ash Paper Trail audit logs (versions 0.3.0-0.6.x) allows any principal with read access to the version resource table to recover credentials, tokens, or other sensitive values stored inside embedded resources, union types, or lists. The redaction logic in `maybe_redact_changes/3` and `AshPaperTrail.Resource.Changes.CreateNewVersion` only inspects top-level resource attributes for the `sensitive?` flag, never recursing into nested structures, so a parent attribute that is not itself marked sensitive silently passes its embedded sensitive children through to the version table in cleartext. No public exploit has been identified and the issue is not listed in CISA KEV; a vendor-released patch is available at version 0.7.0.
Cleartext storage of sensitive Ash resource attributes in AshPaperTrail versions 0.1.1 through 0.6.x allows any actor with read access to the generated version resource to recover plaintext values of fields marked `sensitive? true`. The library's `CreateVersionResource` transformer incorrectly derives the sensitivity flag for the `changes` map from the `ignore_attributes` exclusion list rather than from the actual tracked attributes, causing the map to always be declared `sensitive? false` and `public? true`, which bypasses Ash's built-in redaction and exposes sensitive values in API responses, logs, and inspect output. No public exploit is identified and no active exploitation is confirmed; a vendor patch was released in version 0.7.0.