Zach Daniel / Ash Project

Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts

Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash

Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle

Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length

AshAi aggregate tool can read field-policy-protected fields

AshLua eval read operations can read field-policy-protected fields via aggregates

Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata

Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata

AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes