Peter Ullrich

Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions

AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Path traversal in AshAdmin file uploads via unsanitized client filename

AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message

AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant

CDATA Section Breakout via Unsanitised ]]> in xml_builder

Element and Attribute Names Injected Verbatim into XML Output in xml_builder

Round-trip Corruption via Improper Entity Escaping in xml_builder

html_sanitize_ex HTML5 scrubber keeps attacker-supplied `<object>` elements, allowing untrusted content embedding

html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking