ash-project ash_typescript prior 0.18.0 Request request_handler.ex Ash.Type.cast_input input validation

Summaryinfo

A vulnerability was found in ash-project ash_typescript and classified as critical. Affected is the function Ash.Type.cast_input of the file lib/ash_typescript/typed_controller/request_handler.ex of the component Request Handler. The manipulation results in input validation. This vulnerability is identified as CVE-2026-82732. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in ash-project ash_typescript. Affected is the function Ash.Type.cast_input of the file lib/ash_typescript/typed_controller/request_handler.ex of the component Request Handler. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ash_typescript/typed_controller/request_handler.ex calls Ash.Type.cast_input/3 and treats an {:ok, cast} result as fully validated. In Ash these are separate steps: cast_input/3 only coerces the term, while every constraint declared on the argument is applied by Ash.Type.apply_constraints/3, which this path never calls. Constraints such as one_of, max_length, min and max, and match are therefore inert, so a value outside a declared allowlist is accepted and passed to the route handler. Codegen renders the same constraints into the generated TypeScript types, so an allowlist appears enforced to a TypeScript caller while any other HTTP client ignores it. Empty-string to nil normalization also lives in apply_constraints, so the allow_nil?: false check accepts "" for a required argument. Where a constraint gates a role, a status, or a sort direction, this becomes a privilege or state-machine bypass. This issue affects ash_typescript: from 0.15.0 before 0.18.0.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-82732 since 08/31/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Technical details are known, but there is no available exploit.

Upgrading to version 0.18.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_typescript

Website

• Product: https://github.com/ash-project/ash_typescript/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion