Ash Framework vulnerabilities

2 known vulnerabilities in Ash Framework from Ash-hq. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  ash: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-67579Aug 12, 2026Ash-project

  Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read action

• 7.5 High severity

  ash: Allocation of Resources Without Limits or Throttling

  CVE-2026-34593Apr 2, 2026Ash-project

  Ash Framework is a declarative, extensible framework for building Elixir applications. Prior to version 3.22.0, Ash.Type.Module.cast_input/2 unconditionally creates a new Erlang atom via Module.concat([value]) for any user-supplied binary string that starts wi