ash-project/ash Security Advisories | GitStock

medium2026-09-24

Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets

GHSA-f4hc-ppw9-4hhw · CVE-2026-55736

high2026-04-01

Ash.Type.Module.cast_input/2 atom exhaustion via unchecked Module.concat allows BEAM VM crash

GHSA-jjf9-w5vj-r6vp · CVE-2026-34593

high2025-10-17

Ash has authorization bypass when bypass policy condition evaluates to true

GHSA-pcxq-fjp3-r752 · CVE-2025-48044

high2025-10-13

Ash Framework: Filter authorization misapplies impossible bypass/runtime policies

GHSA-7r7f-9xpj-jmr7 · CVE-2025-48043

high2025-09-15

Before action, Ash's hooks may execute in certain scenarios despite a request being forbidden

GHSA-jj4j-x5ww-cwh9 · CVE-2025-48042