Ash Sql
Monthly
Cross-tenant aggregate data leakage in ash_sql affects Elixir applications using schema-based multitenancy with strategy(:context), covering versions 0.1.0 through 0.7.0. The AshSql.AggregateQuery.add_single_aggs/5 function discards the tenant schema prefix when rebuilding outer queries for distinct aggregates, causing aggregate computations to silently read the repository default schema instead of the tenant's isolated schema. An authenticated tenant user can thereby receive aggregate values - counts, sums, or other statistics - derived from another tenant's rows, breaching the core data isolation guarantee of the multitenant deployment. No public exploit has been identified and the issue is not listed in CISA KEV.
SQL LIKE wildcard injection in ash_sql (Elixir, versions 0.1.1-rc.10 through 0.7.0) allows any user who can supply a search string to the contains/2, string_starts_with/2, or string_ends_with/2 filter functions to reintroduce live LIKE wildcards that the escape helper was intended to neutralize. The escape helper prefixes % and _ with backslash but never first escapes a backslash already present in user input, so the sequence \% survives escaping with its % intact as an unescaped wildcard, enabling attackers to widen query matches, evade negated filter guards, or crash individual queries with a trailing lone backslash. No public exploit has been identified at time of analysis, and a vendor-released fix is available in version 0.7.1.
Incorrect string trimming in ash_sql causes divergent behavior between SQL-layer and in-memory evaluation of the `string_trim/1` function, enabling users to pad string fields with tab, newline, carriage-return, or form-feed characters to bypass trimmed uniqueness or equality checks. All ash_sql versions from 0.1.0 up to (not including) 0.7.1 are affected wherever `string_trim/1` appears in Ash filters, validations, or identity constraints that are evaluated at the SQL layer. No public exploit has been identified and no active exploitation is confirmed; the overall risk is low (CVSS 4.0: 2.1), but the bypass can permit duplicate record creation or filter evasion in affected applications.
Cross-tenant aggregate data leakage in ash_sql affects Elixir applications using schema-based multitenancy with strategy(:context), covering versions 0.1.0 through 0.7.0. The AshSql.AggregateQuery.add_single_aggs/5 function discards the tenant schema prefix when rebuilding outer queries for distinct aggregates, causing aggregate computations to silently read the repository default schema instead of the tenant's isolated schema. An authenticated tenant user can thereby receive aggregate values - counts, sums, or other statistics - derived from another tenant's rows, breaching the core data isolation guarantee of the multitenant deployment. No public exploit has been identified and the issue is not listed in CISA KEV.
SQL LIKE wildcard injection in ash_sql (Elixir, versions 0.1.1-rc.10 through 0.7.0) allows any user who can supply a search string to the contains/2, string_starts_with/2, or string_ends_with/2 filter functions to reintroduce live LIKE wildcards that the escape helper was intended to neutralize. The escape helper prefixes % and _ with backslash but never first escapes a backslash already present in user input, so the sequence \% survives escaping with its % intact as an unescaped wildcard, enabling attackers to widen query matches, evade negated filter guards, or crash individual queries with a trailing lone backslash. No public exploit has been identified at time of analysis, and a vendor-released fix is available in version 0.7.1.
Incorrect string trimming in ash_sql causes divergent behavior between SQL-layer and in-memory evaluation of the `string_trim/1` function, enabling users to pad string fields with tab, newline, carriage-return, or form-feed characters to bypass trimmed uniqueness or equality checks. All ash_sql versions from 0.1.0 up to (not including) 0.7.1 are affected wherever `string_trim/1` appears in Ash filters, validations, or identity constraints that are evaluated at the SQL layer. No public exploit has been identified and no active exploitation is confirmed; the overall risk is low (CVSS 4.0: 2.1), but the bypass can permit duplicate record creation or filter evasion in affected applications.