Peter Ullrich

AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data

Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql

Same-named aggregates with differing filters are conflated in AshSql

Unescaped backslash allows LIKE wildcard injection in AshSql string search

SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql

Unbounded handle_error recursion enables denial of service in AshOban triggers

Job argument injection via :args overrides primary_key and tenant in AshOban

JSON path injection via unescaped get_path segments in AshSqlite

Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking