ash-project ash_ai 0.1.0 AshAi.Changes.Vectorize information exposure

Summaryinfo

A vulnerability classified as problematic was found in ash-project ash_ai 0.1.0. This impacts the function AshAi.Changes.Vectorize. Such manipulation leads to information exposure. This vulnerability is listed as CVE-2026-75760. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in ash-project ash_ai 0.1.0. Affected by this issue is the function AshAi.Changes.Vectorize. The manipulation with an unknown input leads to a information exposure vulnerability. Using CWE to declare the problem leads to CWE-209. The product generates an error message that includes sensitive information about its environment, users, or associated data. Impacted is confidentiality. CVE summarizes:

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message inspected the raw error term (An error occurred while generating embeddings: #{inspect(error)}). A plain-string add_error produces an Ash.Error.Changes.InvalidChanges in the :invalid class, which AshJsonApi and AshGraphql render back to the caller. The embedding client's error term is not sanitized, so it can carry the request URL, the provider response body, and, for HTTP clients that keep the request in the error struct, the outbound Authorization header with the provider API key. Failures are attacker-reachable via oversized or malformed vectorized content. The fix logs the raw error and returns a generic message. This issue affects ash_ai: from 0.1.0 before 1.0.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-75760 since 08/31/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 1.0.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_ai

Version

• 0.1.0

Website

• Product: https://github.com/ash-project/ash_ai/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion