ash
A declarative, extensible framework for building Elixir applications.
Security Advisories for ash in hex
Medium
12 days ago
Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts
hex
ash
High
16 days ago
Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash
hex
ash
Medium
26 days ago
Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash
hex
ash
Moderate
27 days ago
Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets
hex
ash
Medium
about 1 month ago
Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle
hex
ash
Medium
about 2 months ago
Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length
hex
ash
Medium
about 2 months ago
Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor
hex
ash
Medium
about 2 months ago
Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records
hex
ash
Low
about 2 months ago
Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another
hex
ash
Medium
about 2 months ago
Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records
hex
ash
Medium
about 2 months ago
ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness
hex
ash
Low
about 2 months ago
Ash.Reactor change step fails open, skipping a change when its where guard raises
hex
ash
Low
about 2 months ago
Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads
hex
ash
Medium
about 2 months ago
Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory
hex
ash
Low
about 2 months ago
Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion
hex
ash
Low
about 2 months ago
Ash.Type ignores outer array constraints on nested {:array, {:array, type}} inputs
hex
ash
Low
about 2 months ago
Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error
hex
ash
Medium
about 2 months ago
Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service
hex
ash
Medium
about 2 months ago
Ash.Vector wraps the 16-bit dimension header for vectors over 65,535 elements, corrupting data and crashing reads
hex
ash
Low
about 2 months ago
Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass
hex
ash
Medium
about 2 months ago
Match regex runs on over-length input in Ash.Type.String, enabling regex denial of service
hex
ash
Low
about 2 months ago
Non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal
hex
ash
Low
2 months ago
Predicate injection in manage_relationship belongs_to lookup discloses secret lookup keys in Ash
hex
ash
Medium
2 months ago
Memory exhaustion via unbounded deserialization of keyset pagination cursors in Ash.Page.Keyset
hex
ash
High
7 months ago
Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash
hex
ash
High
about 1 year ago
Ash has authorization bypass when bypass policy condition evaluates to true
hex
ash
High
about 1 year ago
Ash Framework: Filter authorization misapplies impossible bypass/runtime policies
hex
ash
High
about 1 year ago
Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization
hex
ash
High
about 1 year ago
Before action, Ash's hooks may execute in certain scenarios despite a request being forbidden
hex
ash
High
about 1 year ago
Before action hooks may execute in certain scenarios despite a request being forbidden
hex
ash