ash-project ash_typescript up to 0.17.x Typed Controller request_handler.ex dispatch information exposure

Summaryinfo

A vulnerability marked as problematic has been reported in ash-project ash_typescript up to 0.17.x. The affected element is the function dispatch of the file lib/ash_typescript/typed_controller/request_handler.ex of the component Typed Controller. This manipulation causes information exposure. This vulnerability appears as CVE-2026-82733. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic was found in ash-project ash_typescript up to 0.17.x. Affected by this vulnerability is the function dispatch of the file lib/ash_typescript/typed_controller/request_handler.ex of the component Typed Controller. The manipulation with an unknown input leads to a information exposure vulnerability. The CWE definition for the vulnerability is CWE-209. The product generates an error message that includes sensitive information about its environment, users, or associated data. As an impact it is known to affect confidentiality. The summary by CVE is:

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal application data from an HTTP 500 response body. When a typed-controller route handler returns anything other than a %Plug.Conn{}, dispatch/3 in lib/ash_typescript/typed_controller/request_handler.ex passes the value to unexpected_return/2, which interpolates inspect(value, limit: 50) directly into the response message. The limit option bounds elements per collection rather than the term as a whole, so a handler falling through with a term such as {:error, %User{}} or a changeset serialises its full field set, including hashed passwords, tokens, and tenant identifiers, into the JSON error returned to the caller. This contradicts the module's own posture elsewhere: the rescue clause gates Exception.message/1 behind AshTypescript.typed_controller_show_raised_errors?/0 and otherwise returns a generic message, while this path is ungated and always echoes. This issue affects ash_typescript: from 0.15.0 before 0.18.0.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-82733 since 08/31/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 0.18.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_typescript

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17

Website

• Product: https://github.com/ash-project/ash_typescript/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion