ash-project ash_admin up to 1.3.0 Typeahead Phoenix.HTML.raw cross site scripting

Summaryinfo

A vulnerability was found in ash-project ash_admin up to 1.3.0. It has been rated as problematic. Impacted is the function Phoenix.HTML.raw of the component Typeahead. Performing a manipulation results in cross site scripting. This vulnerability is known as CVE-2026-77850. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability classified as problematic has been found in ash-project ash_admin up to 1.3.0. This affects the function Phoenix.HTML.raw of the component Typeahead. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser. The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in <b> tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record's label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as <img src=x onerror=...> runs as JavaScript in the admin's session as soon as a matching record appears in the dropdown, giving the attacker the admin's privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup. This issue affects ash_admin: from 0.13.0 before 1.3.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-77850 since 08/31/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

Upgrading to version 1.3.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_admin

Version

• 1.0
• 1.1
• 1.2
• 1.3.0

Website

• Product: https://github.com/ash-project/ash_admin/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion