Jonatan Männchen / EEF

AshAi echoes raw tool exception messages into the conversation, disclosing internal details

AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service

Stored XSS in AshAdmin relationship typeahead via unescaped label_field content

MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

EEx template evaluation of prompt content in AshAi enables remote code execution

Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names

AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle

Cross-tenant subscription disclosure in AshGraphql authorizes notifications in memory without a tenant-scoped read