Zach Daniel / Ash Project

SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql

Unbounded handle_error recursion enables denial of service in AshOban triggers

Job argument injection via :args overrides primary_key and tenant in AshOban

JSON path injection via unescaped get_path segments in AshSqlite

Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking

Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions

AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Path traversal in AshAdmin file uploads via unsanitized client filename

AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message

AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant