local-it/mitgliederverwaltung
local-it/mitgliederverwaltung
2
3
Fork 0
Code Issues 58 Pull requests 7 Projects 1 Releases 6 Packages 1 Activity Actions

chore(deps): update dependency ash_admin to v1.3.1 [security] #581

Merged
moritz merged 1 commit from renovate/hex-ash_admin-vulnerability into main 2026-10-12 12:11:12 +02:00
Conversation 0 Commits 1 Files changed 1 +34 -34
renovate commented 2026-10-08 14:24:42 +02:00
Collaborator
Copy link

This PR contains the following updates:

Package Type Update Change
ash_admin (source) prod minor 1.1.0 → 1.3.1

AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

CVE-2026-75757 / EEF-CVE-2026-75757 / GHSA-3259-55fp-w94j

More information

Details

Summary

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode.

AshAdmin's client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegExp(name + "=([^;]+)")) against the whole document.cookie. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example xactor_authorizing) with Domain=.example.com that flows unvalidated into the admin's LiveSocket connect params. The fix matches cookie names by exact equality.

This issue affects ash_admin: from 0.9.1 before 1.3.1.

Severity

  • CVSS Score: 8.3 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV.

Stored XSS in AshAdmin relationship typeahead via unescaped label_field content

CVE-2026-77850 / EEF-CVE-2026-77850 / GHSA-m23x-576h-73w8

More information

Details

Summary

Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser.

The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in <b> tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record's label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as <img src=x onerror=...> runs as JavaScript in the admin's session as soon as a matching record appears in the dropdown, giving the attacker the admin's privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.

This issue affects ash_admin: from 0.13.0 before 1.3.1.

Severity

  • CVSS Score: 8.4 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV.

AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

CVE-2026-81852 / EEF-CVE-2026-81852 / GHSA-whfj-rrrp-j597

More information

Details

Summary

Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.

When mounted without :csp_nonce_assign_key, AshAdmin.Router.ash_admin/2 defaulted the img, style, and script nonces to the literal constant ash_admin-Ed55GFnX, which AshAdmin.Layouts wrote verbatim into the nonce attribute of its inline <style> and <script> tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application's CSP script-src allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.

This issue affects ash_admin: from 0.10.8 before 1.3.1.

Configurations

The application mounts AshAdmin without :csp_nonce_assign_key and enforces a nonce-based CSP whose script-src allow-lists the default ash_admin-Ed55GFnX value, and has a separate HTML-injection sink on an admin page.

Severity

  • CVSS Score: 2.1 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV.

AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle

CVE-2026-81853 / EEF-CVE-2026-81853 / GHSA-jxr8-hpv2-qp38

More information

Details

Summary

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.

AshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource's primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and :safe still allows any already-interned attribute name. An attacker can therefore encode %{api_token: "guess"} and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; Map.to_list/1 also accepts structs, yielding a bogus __struct__ key. The fix rejects any decoded key that is not a real primary-key field.

This issue affects ash_admin: from 0.1.0 before 1.3.1.

Configurations

The resource has a composite primary key, and the deployment relies on AshAdmin's authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary.

Severity

  • CVSS Score: 2.3 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV.

Path traversal in AshAdmin file uploads via unsanitized client filename

CVE-2026-82673 / EEF-CVE-2026-82673 / GHSA-483p-rgcq-p5j9

More information

Details

Summary

Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server.

AshAdmin.Components.Resource.Form.consume_file_uploads/1 builds the destination as Path.join([tmp_dir, entry.client_name]) and writes it with File.cp!/2. entry.client_name is the browser-supplied filename and is not sanitized, and Path.join/1 does not normalize ... An upload named ../../../../var/www/app/priv/static/x.png therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to :any that checks only the extension. The fix strips path components with Path.basename/1 before joining.

This issue affects ash_admin: from 0.13.7 before 1.3.1.

Severity

  • CVSS Score: 8.3 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

References

This data is provided by OSV.

Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

CVE-2026-82681 / EEF-CVE-2026-82681 / GHSA-j89q-xjrh-c26p

More information

Details

Summary

Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links.

The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because Plug.Conn.Query resolves duplicate parameters last-wins and primary_key is interpolated last, a stored key such as foo&action_type=destroy injects parameters that override the link, so an admin clicking edit is sent to a destroy form or an arbitrary resource; a # truncates the query into a fragment. The fix builds every link with URI.encode_query/1, encoding all interpolated values.

This issue affects ash_admin: from 0.3.0-rc.0 before 1.3.1.

Severity

  • CVSS Score: 2.0 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV.

AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)

CVE-2026-82722 / EEF-CVE-2026-82722 / GHSA-wcr6-9rrw-5jhv

More information

Details

Summary

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node.

Two LiveView event handlers interned atoms from unvalidated client input: AshAdmin.PageLive's set_actor built modules from the resource/domain payload with Module.concat/1, and AshAdmin.Components.Resource.Show's calculate converted every submitted form key with String.to_atom/1. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted resource/domain against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned.

This issue affects ash_admin: from 0.1.0 before 1.3.1.

Severity

  • CVSS Score: 8.3 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

References

This data is provided by OSV.

Release Notes

ash-project/ash_admin (ash_admin)

v1.3.1

Compare Source

Bug Fixes:

  • match admin session cookies by exact name (cookie shadowing) (CVE-2026-75757) by Zach Daniel

  • generate a per-request CSP nonce instead of a published constant (CVE-2026-81852) by Zach Daniel

  • reject non-primary-key fields when decoding composite primary keys (filter oracle) (CVE-2026-81853) by Zach Daniel

  • strip path components from uploaded file names (path traversal) (CVE-2026-82673) by Zach Daniel

  • URL-encode admin row-action link parameters (query-parameter injection) (CVE-2026-82681) by Zach Daniel

  • HTML-escape relationship typeahead labels before highlighting (stored XSS) (CVE-2026-77850) by Zach Daniel

  • don't intern atoms from client input in set_actor and calculate events (CVE-2026-82722) by Zach Daniel

  • constrain the admin actor picker to resources marked as actors by Zach Daniel

  • parse TypedStruct as map in forms for update actions by Amish Patel

  • handle nil values when rendering AshTypedStructures by Guilherme Bordallo

v1.3.0

Compare Source

Features:
  • parse struct as map and render as json by Guilherme Bordallo
Bug Fixes:

  • apply the ash binary issue fix to ash_admin as well by Zach Daniel

  • pass actor, authorize?, and tenant in RelationshipField reads by Alec Hartung

v1.2.0

Compare Source

Features:
  • Add drag-and-drop reordering for primitive array fields in forms (#​407) by JoyceJ53
Bug Fixes:

  • support tenant option labels (#​406) by Jakub Skałecki

  • Ensure mobile and desktiop sidebar ids are unique (#​404) by capoccias

  • update for LV 1.2.0 by Zach Daniel

  • format array attribtues in ash_admin by Zach Daniel

Improvements:
  • add support for uuidv7 primary keys (#​413) by StephanH90

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [ash_admin](https://hex.pm/packages/ash_admin) ([source](https://github.com/ash-project/ash_admin)) | prod | minor | `1.1.0` → `1.3.1` | --- ### AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain [CVE-2026-75757](https://nvd.nist.gov/vuln/detail/CVE-2026-75757) / EEF-CVE-2026-75757 / [GHSA-3259-55fp-w94j](https://github.com/advisories/GHSA-3259-55fp-w94j) <details> <summary>More information</summary> #### Details ##### Summary Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies (`tenant`, `actor_resource`, `actor_primary_key`, `actor_action`, `actor_domain`, `actor_authorizing`, `actor_paused`) by matching the cookie name with an unanchored regular expression (`new RegExp(name + "=([^;]+)")`) against the whole `document.cookie`. Any cookie whose name merely ends with the requested name therefore matches, and whichever is serialized first wins. Because cookies are shared across a registrable domain, a compromised sibling subdomain can set a shadowing cookie (for example `xactor_authorizing`) with `Domain=.example.com` that flows unvalidated into the admin's LiveSocket connect params. The fix matches cookie names by exact equality. This issue affects ash_admin: from 0.9.1 before 1.3.1. #### Severity - CVSS Score: 8.3 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/ash-project/ash_admin/security/advisories/GHSA-3259-55fp-w94j](https://github.com/ash-project/ash_admin/security/advisories/GHSA-3259-55fp-w94j) - [https://cna.erlef.org/cves/CVE-2026-75757.html](https://cna.erlef.org/cves/CVE-2026-75757.html) - [https://github.com/ash-project/ash_admin/commit/e93a3408a85035e1f90275d02bc2470c96095e56](https://github.com/ash-project/ash_admin/commit/e93a3408a85035e1f90275d02bc2470c96095e56) - [https://hex.pm/packages/ash_admin](https://hex.pm/packages/ash_admin) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-75757). </details> --- ### Stored XSS in AshAdmin relationship typeahead via unescaped label_field content [CVE-2026-77850](https://nvd.nist.gov/vuln/detail/CVE-2026-77850) / EEF-CVE-2026-77850 / [GHSA-m23x-576h-73w8](https://github.com/advisories/GHSA-m23x-576h-73w8) <details> <summary>More information</summary> #### Details ##### Summary Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser. The relationship typeahead components `AshAdmin.Components.Resource.RelationshipField` and `AshAdmin.Components.Resource.ManagedRelationshipSelectField` highlight the matched search term by wrapping it in `<b>` tags and rendering the whole string with `Phoenix.HTML.raw/1`. The highlighted value is the destination record's `label_field`, ordinary database content that is often written by lower-privileged users. Because `raw/1` disables output escaping for the entire string, a stored label such as `<img src=x onerror=...>` runs as JavaScript in the admin's session as soon as a matching record appears in the dropdown, giving the attacker the admin's privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup. This issue affects ash_admin: from 0.13.0 before 1.3.1. #### Severity - CVSS Score: 8.4 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/ash-project/ash_admin/security/advisories/GHSA-m23x-576h-73w8](https://github.com/ash-project/ash_admin/security/advisories/GHSA-m23x-576h-73w8) - [https://cna.erlef.org/cves/CVE-2026-77850.html](https://cna.erlef.org/cves/CVE-2026-77850.html) - [https://github.com/ash-project/ash_admin/commit/07289191ccdac27dd70ab7c6413ed057bc7fdade](https://github.com/ash-project/ash_admin/commit/07289191ccdac27dd70ab7c6413ed057bc7fdade) - [https://hex.pm/packages/ash_admin](https://hex.pm/packages/ash_admin) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-77850). </details> --- ### AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass [CVE-2026-81852](https://nvd.nist.gov/vuln/detail/CVE-2026-81852) / EEF-CVE-2026-81852 / [GHSA-whfj-rrrp-j597](https://github.com/advisories/GHSA-whfj-rrrp-j597) <details> <summary>More information</summary> #### Details ##### Summary Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection. When mounted without `:csp_nonce_assign_key`, `AshAdmin.Router.ash_admin/2` defaulted the img, style, and script nonces to the literal constant `ash_admin-Ed55GFnX`, which `AshAdmin.Layouts` wrote verbatim into the `nonce` attribute of its inline `<style>` and `<script>` tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application's CSP `script-src` allow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request. This issue affects ash_admin: from 0.10.8 before 1.3.1. ##### Configurations The application mounts AshAdmin without `:csp_nonce_assign_key` and enforces a nonce-based CSP whose `script-src` allow-lists the default `ash_admin-Ed55GFnX` value, and has a separate HTML-injection sink on an admin page. #### Severity - CVSS Score: 2.1 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/ash-project/ash_admin/security/advisories/GHSA-whfj-rrrp-j597](https://github.com/ash-project/ash_admin/security/advisories/GHSA-whfj-rrrp-j597) - [https://cna.erlef.org/cves/CVE-2026-81852.html](https://cna.erlef.org/cves/CVE-2026-81852.html) - [https://github.com/ash-project/ash_admin/commit/bc7a1cdf873b16971a8efec35d085f8bb706314f](https://github.com/ash-project/ash_admin/commit/bc7a1cdf873b16971a8efec35d085f8bb706314f) - [https://hex.pm/packages/ash_admin](https://hex.pm/packages/ash_admin) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-81852). </details> --- ### AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle [CVE-2026-81853](https://nvd.nist.gov/vuln/detail/CVE-2026-81853) / EEF-CVE-2026-81853 / [GHSA-jxr8-hpv2-qp38](https://github.com/advisories/GHSA-jxr8-hpv2-qp38) <details> <summary>More information</summary> #### Details ##### Summary Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes. `AshAdmin.Helpers.decode_primary_key/2` decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource's primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and `:safe` still allows any already-interned attribute name. An attacker can therefore encode `%{api_token: "guess"}` and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; `Map.to_list/1` also accepts structs, yielding a bogus `__struct__` key. The fix rejects any decoded key that is not a real primary-key field. This issue affects ash_admin: from 0.1.0 before 1.3.1. ##### Configurations The resource has a composite primary key, and the deployment relies on AshAdmin's authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary. #### Severity - CVSS Score: 2.3 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/ash-project/ash_admin/security/advisories/GHSA-jxr8-hpv2-qp38](https://github.com/ash-project/ash_admin/security/advisories/GHSA-jxr8-hpv2-qp38) - [https://cna.erlef.org/cves/CVE-2026-81853.html](https://cna.erlef.org/cves/CVE-2026-81853.html) - [https://github.com/ash-project/ash_admin/commit/3c3e905d47f1155dcc1ca3fb347348b05a66065a](https://github.com/ash-project/ash_admin/commit/3c3e905d47f1155dcc1ca3fb347348b05a66065a) - [https://hex.pm/packages/ash_admin](https://hex.pm/packages/ash_admin) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-81853). </details> --- ### Path traversal in AshAdmin file uploads via unsanitized client filename [CVE-2026-82673](https://nvd.nist.gov/vuln/detail/CVE-2026-82673) / EEF-CVE-2026-82673 / [GHSA-483p-rgcq-p5j9](https://github.com/advisories/GHSA-483p-rgcq-p5j9) <details> <summary>More information</summary> #### Details ##### Summary Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in ash-project ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server. `AshAdmin.Components.Resource.Form.consume_file_uploads/1` builds the destination as `Path.join([tmp_dir, entry.client_name])` and writes it with `File.cp!/2`. `entry.client_name` is the browser-supplied filename and is not sanitized, and `Path.join/1` does not normalize `..`. An upload named `../../../../var/www/app/priv/static/x.png` therefore escapes the random temp directory and lands anywhere the BEAM user can write, enabling arbitrary file write and potentially remote code execution by overwriting application assets, configuration, or cron/ssh files. The only guard is an extension allowlist defaulting to `:any` that checks only the extension. The fix strips path components with `Path.basename/1` before joining. This issue affects ash_admin: from 0.13.7 before 1.3.1. #### Severity - CVSS Score: 8.3 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N` #### References - [https://github.com/ash-project/ash_admin/security/advisories/GHSA-483p-rgcq-p5j9](https://github.com/ash-project/ash_admin/security/advisories/GHSA-483p-rgcq-p5j9) - [https://cna.erlef.org/cves/CVE-2026-82673.html](https://cna.erlef.org/cves/CVE-2026-82673.html) - [https://github.com/ash-project/ash_admin/commit/4bb41cb697f3d9be58462d727aed75aba76efc82](https://github.com/ash-project/ash_admin/commit/4bb41cb697f3d9be58462d727aed75aba76efc82) - [https://hex.pm/packages/ash_admin](https://hex.pm/packages/ash_admin) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-82673). </details> --- ### Query-parameter injection in AshAdmin row-action links via unencoded string primary keys [CVE-2026-82681](https://nvd.nist.gov/vuln/detail/CVE-2026-82681) / EEF-CVE-2026-82681 / [GHSA-j89q-xjrh-c26p](https://github.com/advisories/GHSA-j89q-xjrh-c26p) <details> <summary>More information</summary> #### Details ##### Summary Improper Encoding or Escaping of Output vulnerability in ash-project ash_admin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The `Table`, `DataTable`, and `Show` components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because `Plug.Conn.Query` resolves duplicate parameters last-wins and `primary_key` is interpolated last, a stored key such as `foo&action_type=destroy` injects parameters that override the link, so an admin clicking `edit` is sent to a destroy form or an arbitrary resource; a `#` truncates the query into a fragment. The fix builds every link with `URI.encode_query/1`, encoding all interpolated values. This issue affects ash_admin: from 0.3.0-rc.0 before 1.3.1. #### Severity - CVSS Score: 2.0 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/ash-project/ash_admin/security/advisories/GHSA-j89q-xjrh-c26p](https://github.com/ash-project/ash_admin/security/advisories/GHSA-j89q-xjrh-c26p) - [https://cna.erlef.org/cves/CVE-2026-82681.html](https://cna.erlef.org/cves/CVE-2026-82681.html) - [https://github.com/ash-project/ash_admin/commit/8e8ef91e8ba07498053887c6212f8b0f08178df6](https://github.com/ash-project/ash_admin/commit/8e8ef91e8ba07498053887c6212f8b0f08178df6) - [https://hex.pm/packages/ash_admin](https://hex.pm/packages/ash_admin) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-82681). </details> --- ### AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS) [CVE-2026-82722](https://nvd.nist.gov/vuln/detail/CVE-2026-82722) / EEF-CVE-2026-82722 / [GHSA-wcr6-9rrw-5jhv](https://github.com/advisories/GHSA-wcr6-9rrw-5jhv) <details> <summary>More information</summary> #### Details ##### Summary Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_admin lets any client that can reach the admin LiveView exhaust the BEAM atom table and crash the entire node. Two LiveView event handlers interned atoms from unvalidated client input: `AshAdmin.PageLive`'s `set_actor` built modules from the `resource`/`domain` payload with `Module.concat/1`, and `AshAdmin.Components.Resource.Show`'s `calculate` converted every submitted form key with `String.to_atom/1`. Atoms are never garbage collected and the table is capped, so flooding either event with random names mints a new atom per request until the VM aborts, taking down every application on the node. The fix resolves the submitted `resource`/`domain` against the known shown resources and maps calculation keys to declared arguments, so no client-supplied string is interned. This issue affects ash_admin: from 0.1.0 before 1.3.1. #### Severity - CVSS Score: 8.3 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H` #### References - [https://github.com/ash-project/ash_admin/security/advisories/GHSA-wcr6-9rrw-5jhv](https://github.com/ash-project/ash_admin/security/advisories/GHSA-wcr6-9rrw-5jhv) - [https://cna.erlef.org/cves/CVE-2026-82722.html](https://cna.erlef.org/cves/CVE-2026-82722.html) - [https://github.com/ash-project/ash_admin/commit/731dffa09416d68f4ad3a0b6ee146b285ca0083b](https://github.com/ash-project/ash_admin/commit/731dffa09416d68f4ad3a0b6ee146b285ca0083b) - [https://hex.pm/packages/ash_admin](https://hex.pm/packages/ash_admin) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-82722). </details> --- ### Release Notes <details> <summary>ash-project/ash_admin (ash_admin)</summary> ### [`v1.3.1`](https://github.com/ash-project/ash_admin/blob/HEAD/CHANGELOG.md#v131-2026-08-31) [Compare Source](https://github.com/ash-project/ash_admin/compare/v1.3.0...v1.3.1) ##### Bug Fixes: - match admin session cookies by exact name (cookie shadowing) (CVE-2026-75757) by Zach Daniel - generate a per-request CSP nonce instead of a published constant (CVE-2026-81852) by Zach Daniel - reject non-primary-key fields when decoding composite primary keys (filter oracle) (CVE-2026-81853) by Zach Daniel - strip path components from uploaded file names (path traversal) (CVE-2026-82673) by Zach Daniel - URL-encode admin row-action link parameters (query-parameter injection) (CVE-2026-82681) by Zach Daniel - HTML-escape relationship typeahead labels before highlighting (stored XSS) (CVE-2026-77850) by Zach Daniel - don't intern atoms from client input in set\_actor and calculate events (CVE-2026-82722) by Zach Daniel - constrain the admin actor picker to resources marked as actors by Zach Daniel - parse TypedStruct as map in forms for update actions by Amish Patel - handle nil values when rendering AshTypedStructures by Guilherme Bordallo ### [`v1.3.0`](https://github.com/ash-project/ash_admin/blob/HEAD/CHANGELOG.md#v130-2026-08-12) [Compare Source](https://github.com/ash-project/ash_admin/compare/v1.2.0...v1.3.0) ##### Features: - parse struct as map and render as json by Guilherme Bordallo ##### Bug Fixes: - apply the ash binary issue fix to ash\_admin as well by Zach Daniel - pass actor, authorize?, and tenant in RelationshipField reads by Alec Hartung ### [`v1.2.0`](https://github.com/ash-project/ash_admin/blob/HEAD/CHANGELOG.md#v120-2026-07-20) [Compare Source](https://github.com/ash-project/ash_admin/compare/v1.1.0...v1.2.0) ##### Features: - Add drag-and-drop reordering for primitive array fields in forms ([#&#8203;407](https://github.com/ash-project/ash_admin/issues/407)) by JoyceJ53 ##### Bug Fixes: - support tenant option labels ([#&#8203;406](https://github.com/ash-project/ash_admin/issues/406)) by Jakub Skałecki - Ensure mobile and desktiop sidebar ids are unique ([#&#8203;404](https://github.com/ash-project/ash_admin/issues/404)) by capoccias - update for LV 1.2.0 by Zach Daniel - format array attribtues in ash\_admin by Zach Daniel ##### Improvements: - add support for uuidv7 primary keys ([#&#8203;413](https://github.com/ash-project/ash_admin/issues/413)) by StephanH90 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNjUuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE2NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJhdXRvbWF0ZWQiLCJkZXBlbmRlbmNpZXMiLCJyZW5vdmF0ZSIsInNlY3VyaXR5Il19-->
chore(deps): update dependency ash_admin to v1.3.1 [security]
Some checks reported errors
continuous-integration/drone/push Build was killed
Details
9ce6e94d7b
renovate force-pushed renovate/hex-ash_admin-vulnerability from 9ce6e94d7b
Some checks reported errors
continuous-integration/drone/push Build was killed
Details
to 5c602594be
Some checks failed
continuous-integration/drone/push Build is failing
Details
2026-10-08 21:24:33 +02:00 Compare
renovate force-pushed renovate/hex-ash_admin-vulnerability from 5c602594be
Some checks failed
continuous-integration/drone/push Build is failing
Details
to 1d7ce095e8
All checks were successful
continuous-integration/drone/push Build is passing
Details
2026-10-10 02:04:45 +02:00 Compare
renovate force-pushed renovate/hex-ash_admin-vulnerability from 1d7ce095e8
All checks were successful
continuous-integration/drone/push Build is passing
Details
to 53cb03fe5c
All checks were successful
continuous-integration/drone/push Build is passing
Details
2026-10-11 02:05:17 +02:00 Compare
renovate force-pushed renovate/hex-ash_admin-vulnerability from 53cb03fe5c
All checks were successful
continuous-integration/drone/push Build is passing
Details
to 80256bf8cf
All checks were successful
continuous-integration/drone/push Build is passing
Details
continuous-integration/drone/promote/production Build is passing
Details
2026-10-12 02:04:52 +02:00 Compare
moritz merged commit 070240df04 into main 2026-10-12 12:11:12 +02:00
moritz deleted branch renovate/hex-ash_admin-vulnerability 2026-10-12 12:11:12 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
high priority

   
invalid
Something is wrong

  
L
5 h

  
low priority

   
M
3 h

  
medium priority

   
needs refinement

   
optional

   
question
More information is needed

  
S
1 h

  
security

   
technical improvement

   
UX Improvement

   
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
high priority
invalid
L
low priority
M
medium priority
needs refinement
optional
question
S
security
technical improvement
UX Improvement
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
local-it/mitgliederverwaltung!581
No description provided.