CVE-2026-82731 in ash_typescript
Summary
by MITRE • 09/01/2026
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redirect a generated client's request, and the credentials attached to it, to an unintended route or an external origin.
The URL builders in lib/ash_typescript/typed_controller/codegen/route_renderer.ex replace each :param placeholder with a bare template interpolation and never call encodeURIComponent, so the value reaches executeTypedControllerRequest raw. A value containing ../ is normalised away by the fetch URL resolver and reaches a different route, while ? or # truncates the path and can smuggle or override query parameters. For a route whose path begins with a parameter, a value such as /evil.example.com/x yields the protocol-relative URL //evil.example.com/x, sending the request and the credentials from TypedControllerConfig to an attacker-controlled host. Nothing constrains the value at runtime: get_path_param_type/2 emits only a TypeScript type, which is erased.
The query-string path is unaffected, since URLSearchParams.set encodes its own values.
This issue affects ash_typescript: from 0.15.0 before 0.18.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in the ash_typescript library constitutes a critical Open Redirect flaw that stems from improper handling of user-supplied path parameters during client-side request generation. This security defect allows an attacker who controls or influences the value of a URL path parameter to manipulate the destination of HTTP requests initiated by the application's frontend code. The core technical failure lies within the route rendering logic located in lib/ash_typescript/typed_controller/codegen/route_renderer.ex, where template interpolation is used directly without any form of input sanitization or encoding. Specifically, when a :param placeholder is replaced with its corresponding value, the system performs a bare string substitution rather than applying URL-encoding functions such as encodeURIComponent. This oversight means that special characters and sequences within the parameter value are preserved in their raw form, allowing them to be interpreted by the browser's native fetch API or underlying HTTP client logic rather than being treated strictly as literal path segments.
The operational impact of this flaw is severe because it enables credential leakage and unauthorized redirections through several distinct mechanisms depending on the structure of the injected payload. If an attacker provides a value containing directory traversal sequences such as ../, the browser's URL resolver normalizes these away during request execution, causing the request to bypass intended route constraints and land on a different internal endpoint that may have higher privileges or expose sensitive data. More critically, if the targeted route begins with a parameterized segment, an attacker can supply a value starting with double slashes, such as //evil.example.com/x. The browser interprets this sequence as a protocol-relative URL, effectively stripping away the intended host and path of the application entirely. Consequently, the request is sent to an external domain controlled by the attacker while retaining any authentication credentials or session tokens configured in the TypedControllerConfig object. This results in the theft of sensitive user data and potential account takeover scenarios where the victim's identity is used to perform actions on malicious infrastructure.
Further exploitation vectors exist through the manipulation of query strings and fragment identifiers within the parameter value. By injecting characters such as question marks or hash symbols, an attacker can truncate the intended path component and smuggle arbitrary query parameters into the request. This capability allows for the override of existing query string values, potentially altering the behavior of backend endpoints that rely on these parameters to determine access control decisions or data filtering logic. Although the library correctly handles URLSearchParams.set by encoding its own values, this protection does not extend to path-based parameter injection because those values are processed through a different code path that lacks equivalent safeguards. The absence of runtime validation is compounded by the fact that type checking in TypeScript is purely compile-time and erased during JavaScript execution, meaning no client-side logic can reliably prevent or detect these malicious inputs once they reach the network layer.
From a classification perspective, this vulnerability aligns with CWE-601, URL Redirection to Untrusted Site (Open Redirect), as it involves directing users from a trusted domain to an untrusted one through manipulated input data. It also relates closely to CWE-79, Cross-site Scripting, in contexts where the redirect might be used for phishing attacks or combined with other injection techniques to compromise user trust. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1566.002, Phishing: Spearphishing Link, as attackers can craft deceptive links that appear legitimate until they trigger a redirection to malicious sites. The vulnerability affects versions of ash_typescript from 0.15.0 up to but not including version 0.18.0, indicating that the issue was present in multiple releases before being addressed.
To mitigate this risk, developers must ensure that all user-supplied values used in URL construction are properly encoded using standard functions like encodeURIComponent before they are inserted into path segments or query strings. It is essential to validate input at both the client and server sides, although client-side validation alone is insufficient for security. Implementing a allowlist of permitted characters for path parameters can further reduce the attack surface by rejecting inputs that contain special URL delimiters such as slashes, question marks, hashes, or double-slash sequences. Additionally, reviewing the route rendering logic to enforce strict separation between literal path components and dynamic parameter values will prevent the browser from misinterpreting injected data as structural elements of the URL. Upgrading to version 0.18.0 or later is recommended if it includes patches for this specific encoding oversight in the code generation module.