CVE-2026-105283 (GCVE-0-2026-105283)
Vulnerability from cvelistv5 – Published: 2026-10-12 11:16 – Updated: 2026-10-12 11:16
VLAI
EPSS
VEX
Title
Internal error terms inspected into AshTypescript RPC error responses
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for.
AshTypescript.Rpc.ErrorBuilder.build_error_response/1 in lib/ash_typescript/rpc/error_builder.ex renders a pipeline error term that matches no specific clause with inspect/1 and places the result in details.error of the client-facing error. Ash exceptions take a separate path in AshTypescript.Rpc.Errors where unhandled cases are redacted behind an errorId, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where cast_map_to_struct/2 in lib/ash_typescript/rpc/input_formatter.ex throws the raw Ash.Type cast error into the builder, and field selection on a generic action that returns a primitive, where format_field_type/1 inspects the full Ash.Info.Manifest.Type struct into vars.returnType. Resource module names in vars.resource are not treated as sensitive and are out of scope.
This issue affects ash_typescript: from 0.1.0 before 0.19.1.
Severity
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_typescript/sec… | relatedvendor-advisory |
| https://cna.erlef.org/cves/CVE-2026-105283.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-105283 | related |
| https://github.com/ash-project/ash_typescript/com… | related |
| https://github.com/ash-project/ash_typescript/com… | patch |
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| ash-project | ash_typescript |
Affected:
0.1.0 , < 0.19.1
(semver)
cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:* |
||
| ash-project | ash_typescript |
Affected:
8e204ce34e24a158cf22a2dac4d53c44716c9e30 , < 4b3c65203ee78dc992d6d2e6559625c5460a01cd
(git)
cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027",
"\u0027Elixir.AshTypescript.Rpc.InputFormatter\u0027",
"\u0027Elixir.AshTypescript.Rpc\u0027"
],
"packageName": "ash_typescript",
"packageURL": "pkg:hex/ash_typescript",
"product": "ash_typescript",
"programFiles": [
"lib/ash_typescript/rpc/error_builder.ex",
"lib/ash_typescript/rpc/input_formatter.ex",
"lib/ash_typescript/rpc.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027:build_error_response/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027:format_field_type/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.InputFormatter\u0027:cast_map_to_struct/2"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:validate_action/3"
}
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.19.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027",
"\u0027Elixir.AshTypescript.Rpc.InputFormatter\u0027",
"\u0027Elixir.AshTypescript.Rpc\u0027"
],
"packageName": "ash-project/ash_typescript",
"packageURL": "pkg:github/ash-project/ash_typescript",
"product": "ash_typescript",
"programFiles": [
"lib/ash_typescript/rpc/error_builder.ex",
"lib/ash_typescript/rpc/input_formatter.ex",
"lib/ash_typescript/rpc.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027:build_error_response/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027:format_field_type/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.InputFormatter\u0027:cast_map_to_struct/2"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:validate_action/3"
}
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"versions": [
{
"lessThan": "4b3c65203ee78dc992d6d2e6559625c5460a01cd",
"status": "affected",
"version": "8e204ce34e24a158cf22a2dac4d53c44716c9e30",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application exposes an AshTypescript RPC endpoint over HTTP or a channel and has an action with a struct-typed argument, or a generic action with a primitive return type that accepts field selection.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application exposes an AshTypescript RPC endpoint over HTTP or a channel and has an action with a struct-typed argument, or a generic action with a primitive return type that accepts field selection."
}
],
"value": "The application exposes an AshTypescript RPC endpoint over HTTP or a channel and has an action with a struct-typed argument, or a generic action with a primitive return type that accepts field selection."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.19.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Shoukry / Udin"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Shoukry / Udin"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Torkild Gundersen Kjevik / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-12T09:59:25.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshTypescript.Rpc.ErrorBuilder.build_error_response/1\u003c/code\u003e in \u003ccode\u003elib/ash_typescript/rpc/error_builder.ex\u003c/code\u003e renders a pipeline error term that matches no specific clause with \u003ccode\u003einspect/1\u003c/code\u003e and places the result in \u003ccode\u003edetails.error\u003c/code\u003e of the client-facing error. Ash exceptions take a separate path in \u003ccode\u003eAshTypescript.Rpc.Errors\u003c/code\u003e where unhandled cases are redacted behind an \u003ccode\u003eerrorId\u003c/code\u003e, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where \u003ccode\u003ecast_map_to_struct/2\u003c/code\u003e in \u003ccode\u003elib/ash_typescript/rpc/input_formatter.ex\u003c/code\u003e throws the raw \u003ccode\u003eAsh.Type\u003c/code\u003e cast error into the builder, and field selection on a generic action that returns a primitive, where \u003ccode\u003eformat_field_type/1\u003c/code\u003e inspects the full \u003ccode\u003eAsh.Info.Manifest.Type\u003c/code\u003e struct into \u003ccode\u003evars.returnType\u003c/code\u003e. Resource module names in \u003ccode\u003evars.resource\u003c/code\u003e are not treated as sensitive and are out of scope.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_typescript: from 0.1.0 before 0.19.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for.\n\n`AshTypescript.Rpc.ErrorBuilder.build_error_response/1` in `lib/ash_typescript/rpc/error_builder.ex` renders a pipeline error term that matches no specific clause with `inspect/1` and places the result in `details.error` of the client-facing error. Ash exceptions take a separate path in `AshTypescript.Rpc.Errors` where unhandled cases are redacted behind an `errorId`, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where `cast_map_to_struct/2` in `lib/ash_typescript/rpc/input_formatter.ex` throws the raw `Ash.Type` cast error into the builder, and field selection on a generic action that returns a primitive, where `format_field_type/1` inspects the full `Ash.Info.Manifest.Type` struct into `vars.returnType`. Resource module names in `vars.resource` are not treated as sensitive and are out of scope.\n\nThis issue affects ash_typescript: from 0.1.0 before 0.19.1."
}
],
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for.\n\nAshTypescript.Rpc.ErrorBuilder.build_error_response/1 in lib/ash_typescript/rpc/error_builder.ex renders a pipeline error term that matches no specific clause with inspect/1 and places the result in details.error of the client-facing error. Ash exceptions take a separate path in AshTypescript.Rpc.Errors where unhandled cases are redacted behind an errorId, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where cast_map_to_struct/2 in lib/ash_typescript/rpc/input_formatter.ex throws the raw Ash.Type cast error into the builder, and field selection on a generic action that returns a primitive, where format_field_type/1 inspects the full Ash.Info.Manifest.Type struct into vars.returnType. Resource module names in vars.resource are not treated as sensitive and are out of scope.\n\nThis issue affects ash_typescript: from 0.1.0 before 0.19.1."
}
],
"impacts": [
{
"capecId": "CAPEC-54",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAny client able to call the RPC endpoint can submit malformed struct arguments or field selections and read internal Elixir terms, including any state the failing pipeline step carried, from the error response.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Any client able to call the RPC endpoint can submit malformed struct arguments or field selections and read internal Elixir terms, including any state the failing pipeline step carried, from the error response."
}
],
"value": "Any client able to call the RPC endpoint can submit malformed struct arguments or field selections and read internal Elixir terms, including any state the failing pipeline step carried, from the error response."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T11:16:30.582Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GitHub Advisory",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-7gxc-w225-f7f3"
},
{
"name": "EEF CNA record for CVE-2026-105283",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-105283.html"
},
{
"name": "OSV record EEF-CVE-2026-105283",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-105283"
},
{
"name": "Introducing commit 8e204ce in ash-project/ash_typescript",
"tags": [
"related"
],
"url": "https://github.com/ash-project/ash_typescript/commit/8e204ce34e24a158cf22a2dac4d53c44716c9e30"
},
{
"name": "Fix commit 4b3c652 in ash-project/ash_typescript",
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_typescript/commit/4b3c65203ee78dc992d6d2e6559625c5460a01cd"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Internal error terms inspected into AshTypescript RPC error responses",
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eExpose an AshTypescript RPC action that takes a struct-typed argument, for example an \u003ccode\u003eassignee\u003c/code\u003e argument whose struct has a UUID \u003ccode\u003eid\u003c/code\u003e field.\u003c/li\u003e\n\u003cli\u003eSend the action request with an invalid nested value, such as \u003ccode\u003e{\"assignee\": {\"id\": \"not-a-uuid\", \"name\": \"x\", \"email\": \"e\"}}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRead the response: each pair of the raw \u003ccode\u003eAsh.Type\u003c/code\u003e cast error is returned as its own \u003ccode\u003efield_validation_error\u003c/code\u003e with the inspected term in \u003ccode\u003edetails.error\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eFor the second path, send a \u003ccode\u003efields\u003c/code\u003e list to a generic action that returns a primitive and read the inspected \u003ccode\u003eAsh.Info.Manifest.Type\u003c/code\u003e struct in \u003ccode\u003evars.returnType\u003c/code\u003e of the resulting error.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Expose an AshTypescript RPC action that takes a struct-typed argument, for example an `assignee` argument whose struct has a UUID `id` field.\n2. Send the action request with an invalid nested value, such as `{\"assignee\": {\"id\": \"not-a-uuid\", \"name\": \"x\", \"email\": \"e\"}}`.\n3. Read the response: each pair of the raw `Ash.Type` cast error is returned as its own `field_validation_error` with the inspected term in `details.error`.\n\nFor the second path, send a `fields` list to a generic action that returns a primitive and read the inspected `Ash.Info.Manifest.Type` struct in `vars.returnType` of the resulting error."
}
],
"value": "* Expose an AshTypescript RPC action that takes a struct-typed argument, for example an assignee argument whose struct has a UUID id field.\n* Send the action request with an invalid nested value, such as {\"assignee\": {\"id\": \"not-a-uuid\", \"name\": \"x\", \"email\": \"e\"}}.\n* Read the response: each pair of the raw Ash.Type cast error is returned as its own field_validation_error with the inspected term in details.error.\n\nFor the second path, send a fields list to a generic action that returns a primitive and read the inspected Ash.Info.Manifest.Type struct in vars.returnType of the resulting error."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Error funnel.\u003c/strong\u003e \u003ccode\u003eAshTypescript.Rpc.run_action/3\u003c/code\u003e runs the request through \u003ccode\u003ePipeline.parse_request/3\u003c/code\u003e, \u003ccode\u003eexecute_ash_action/1\u003c/code\u003e and \u003ccode\u003eprocess_result/2\u003c/code\u003e. Any \u003ccode\u003e{:error, reason}\u003c/code\u003e from these goes to \u003ccode\u003eerror_response/1\u003c/code\u003e, which calls \u003ccode\u003eAshTypescript.Rpc.ErrorBuilder.build_error_response/1\u003c/code\u003e with the raw reason term.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Unredacted fallbacks.\u003c/strong\u003e \u003ccode\u003ebuild_error_response/1\u003c/code\u003e has clauses for the error tuples the pipeline is expected to emit. A two-tuple whose first element is an atom but matches no clause is rendered as \u003ccode\u003efield_validation_error\u003c/code\u003e with \u003ccode\u003edetails.error\u003c/code\u003e set to \u003ccode\u003einspect(error)\u003c/code\u003e, and any other term becomes \u003ccode\u003eunknown_error\u003c/code\u003e with \u003ccode\u003edetails.error\u003c/code\u003e set to \u003ccode\u003einspect(other)\u003c/code\u003e. Ash exceptions never reach these clauses because \u003ccode\u003eAshTypescript.Rpc.Errors\u003c/code\u003e handles them and redacts unhandled ones behind an \u003ccode\u003eerrorId\u003c/code\u003e, so only this path has no redaction.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Reachable triggers.\u003c/strong\u003e \u003ccode\u003eAshTypescript.Rpc.InputFormatter.cast_map_to_struct/2\u003c/code\u003e throws the raw \u003ccode\u003eAsh.Type.cast_input/3\u003c/code\u003e error, a keyword list, when a struct-typed argument fails to cast, and \u003ccode\u003eformat/6\u003c/code\u003e turns the throw into \u003ccode\u003e{:error, term}\u003c/code\u003e for the funnel. Separately, requesting \u003ccode\u003efields\u003c/code\u003e on a generic action whose return type is a primitive produces an \u003ccode\u003e{:invalid_field_selection, :primitive_type, return_type, ...}\u003c/code\u003e tuple whose \u003ccode\u003ereturn_type\u003c/code\u003e is formatted by \u003ccode\u003eformat_field_type/1\u003c/code\u003e, which inspects the whole \u003ccode\u003eAsh.Info.Manifest.Type\u003c/code\u003e struct, constraints and decoration included, into \u003ccode\u003evars.returnType\u003c/code\u003e.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Error funnel.** `AshTypescript.Rpc.run_action/3` runs the request through `Pipeline.parse_request/3`, `execute_ash_action/1` and `process_result/2`. Any `{:error, reason}` from these goes to `error_response/1`, which calls `AshTypescript.Rpc.ErrorBuilder.build_error_response/1` with the raw reason term.\n\n**2. Unredacted fallbacks.** `build_error_response/1` has clauses for the error tuples the pipeline is expected to emit. A two-tuple whose first element is an atom but matches no clause is rendered as `field_validation_error` with `details.error` set to `inspect(error)`, and any other term becomes `unknown_error` with `details.error` set to `inspect(other)`. Ash exceptions never reach these clauses because `AshTypescript.Rpc.Errors` handles them and redacts unhandled ones behind an `errorId`, so only this path has no redaction.\n\n**3. Reachable triggers.** `AshTypescript.Rpc.InputFormatter.cast_map_to_struct/2` throws the raw `Ash.Type.cast_input/3` error, a keyword list, when a struct-typed argument fails to cast, and `format/6` turns the throw into `{:error, term}` for the funnel. Separately, requesting `fields` on a generic action whose return type is a primitive produces an `{:invalid_field_selection, :primitive_type, return_type, ...}` tuple whose `return_type` is formatted by `format_field_type/1`, which inspects the whole `Ash.Info.Manifest.Type` struct, constraints and decoration included, into `vars.returnType`."
}
],
"value": "1. Error funnel. AshTypescript.Rpc.run_action/3 runs the request through Pipeline.parse_request/3, execute_ash_action/1 and process_result/2. Any {:error, reason} from these goes to error_response/1, which calls AshTypescript.Rpc.ErrorBuilder.build_error_response/1 with the raw reason term.\n\n2. Unredacted fallbacks. build_error_response/1 has clauses for the error tuples the pipeline is expected to emit. A two-tuple whose first element is an atom but matches no clause is rendered as field_validation_error with details.error set to inspect(error), and any other term becomes unknown_error with details.error set to inspect(other). Ash exceptions never reach these clauses because AshTypescript.Rpc.Errors handles them and redacts unhandled ones behind an errorId, so only this path has no redaction.\n\n3. Reachable triggers. AshTypescript.Rpc.InputFormatter.cast_map_to_struct/2 throws the raw Ash.Type.cast_input/3 error, a keyword list, when a struct-typed argument fails to cast, and format/6 turns the throw into {:error, term} for the funnel. Separately, requesting fields on a generic action whose return type is a primitive produces an {:invalid_field_selection, :primitive_type, return_type, ...} tuple whose return_type is formatted by format_field_type/1, which inspects the whole Ash.Info.Manifest.Type struct, constraints and decoration included, into vars.returnType."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-105283",
"datePublished": "2026-10-12T11:16:30.582Z",
"dateReserved": "2026-10-10T13:15:02.310Z",
"dateUpdated": "2026-10-12T11:16:30.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-105283",
"date": "2026-10-13",
"epss": "0.00315",
"percentile": "0.22604"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027",
"\u0027Elixir.AshTypescript.Rpc.InputFormatter\u0027",
"\u0027Elixir.AshTypescript.Rpc\u0027"
],
"packageName": "ash_typescript",
"packageURL": "pkg:hex/ash_typescript",
"product": "ash_typescript",
"programFiles": [
"lib/ash_typescript/rpc/error_builder.ex",
"lib/ash_typescript/rpc/input_formatter.ex",
"lib/ash_typescript/rpc.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027:build_error_response/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027:format_field_type/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.InputFormatter\u0027:cast_map_to_struct/2"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:validate_action/3"
}
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0.19.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027",
"\u0027Elixir.AshTypescript.Rpc.InputFormatter\u0027",
"\u0027Elixir.AshTypescript.Rpc\u0027"
],
"packageName": "ash-project/ash_typescript",
"packageURL": "pkg:github/ash-project/ash_typescript",
"product": "ash_typescript",
"programFiles": [
"lib/ash_typescript/rpc/error_builder.ex",
"lib/ash_typescript/rpc/input_formatter.ex",
"lib/ash_typescript/rpc.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027:build_error_response/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.ErrorBuilder\u0027:format_field_type/1"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc.InputFormatter\u0027:cast_map_to_struct/2"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:run_action/3"
},
{
"name": "\u0027Elixir.AshTypescript.Rpc\u0027:validate_action/3"
}
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"versions": [
{
"lessThan": "4b3c65203ee78dc992d6d2e6559625c5460a01cd",
"status": "affected",
"version": "8e204ce34e24a158cf22a2dac4d53c44716c9e30",
"versionType": "git"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for.\n\nAshTypescript.Rpc.ErrorBuilder.build_error_response/1 in lib/ash_typescript/rpc/error_builder.ex renders a pipeline error term that matches no specific clause with inspect/1 and places the result in details.error of the client-facing error. Ash exceptions take a separate path in AshTypescript.Rpc.Errors where unhandled cases are redacted behind an errorId, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where cast_map_to_struct/2 in lib/ash_typescript/rpc/input_formatter.ex throws the raw Ash.Type cast error into the builder, and field selection on a generic action that returns a primitive, where format_field_type/1 inspects the full Ash.Info.Manifest.Type struct into vars.returnType. Resource module names in vars.resource are not treated as sensitive and are out of scope.\n\nThis issue affects ash_typescript: from 0.1.0 before 0.19.1."
}
],
"id": "CVE-2026-105283",
"lastModified": "2026-10-13T14:31:20.750",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
},
"published": "2026-10-12T12:17:12.447",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://cna.erlef.org/cves/CVE-2026-105283.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/ash-project/ash_typescript/commit/4b3c65203ee78dc992d6d2e6559625c5460a01cd"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/ash-project/ash_typescript/commit/8e204ce34e24a158cf22a2dac4d53c44716c9e30"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-7gxc-w225-f7f3"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-105283"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-209"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…