https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 13:14:30 +0000 https://db.gcve.eu/vuln/cve-2026-119613 <p><strong>Affected:</strong> ash-project ash_ai</p> <p>Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail.</p> <p>AshAi.ToToolError gained an implementation for Ash.Error.Unknown.UnknownError that returns the error&#39;s error field as is, and AshAi.Tool.Errors.format/1 sends that text to MCP clients (tool calls and resource reads in AshAi.Mcp.Server) and to the model in AshAi.ToolLoop. Ash stores the full Exception.format/2 output of a raised exception, or inspect/1 of a bare {:error, term} return, in that field. A tool result that cannot be JSON-encoded raises a Protocol.UndefinedError whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller.</p> <p>This issue affects ash_ai: from 1.5.0 before 1.5.1.</p> <p><strong>Affected:</strong> ash-project ash_ai</p> <p>Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail.</p> <p>AshAi.ToToolError gained an implementation for Ash.Error.Unknown.UnknownError that returns the error&#39;s error field as is, and AshAi.Tool.Errors.format/1 sends that text to MCP clients (tool calls and resource reads in AshAi.Mcp.Server) and to the model in AshAi.ToolLoop. Ash stores the full Exception.format/2 output of a raised exception, or inspect/1 of a bare {:error, term} return, in that field. A tool result that cannot be JSON-encoded raises a Protocol.UndefinedError whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller.</p> <p>This issue affects ash_ai: from 1.5.0 before 1.5.1.</p> https://db.gcve.eu/vuln/cve-2026-119613