Zach Daniel / Ash Project

AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error

AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)

AshAi echoes raw tool exception messages into the conversation, disclosing internal details

AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service

Stored XSS in AshAdmin relationship typeahead via unescaped label_field content

MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header

EEx template evaluation of prompt content in AshAi enables remote code execution

Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names