Jonatan Männchen / EEF

Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle

Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation

Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning

Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length

AshAi aggregate tool can read field-policy-protected fields

AshLua eval read operations can read field-policy-protected fields via aggregates

Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata

AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF