ash-project ash_lua up to 0.2.0 Field Exposure AshLua.Runtime read action aggregate path operation information disclosure

Summaryinfo

A vulnerability identified as problematic has been detected in ash-project ash_lua up to 0.2.0. The impacted element is the function read action aggregate path of the file AshLua.Runtime of the component Field Exposure. Performing a manipulation of the argument operation results in information disclosure. This vulnerability is identified as CVE-2026-82586. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic has been found in ash-project ash_lua up to 0.2.0. This affects the function read action aggregate path of the file AshLua.Runtime of the component Field Exposure. The manipulation of the argument operation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's operation aggregate path in AshLua.Runtime took the field name straight from the Lua call and resolved it with only String.to_existing_atom and Ash.Query.Aggregate.new!, neither of which consults the exposed-field allow-list the normal fields path enforces. A script can therefore read the value of any attribute of any record the actor may read, including private sensitive?: true columns, via resource.read({ operation = {"list", "hashed_password"} }); min and max give a value oracle. Anyone able to submit or influence a Lua script can reach this. This issue affects ash_lua: from 0.1.0 before 0.2.1.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-82586 since 09/07/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 0.2.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_lua

Version

• 0.1
• 0.2.0

Website

• Product: https://github.com/ash-project/ash_lua/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion