Zach Daniel / Ash Project

Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash

Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata

Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle

AshAi aggregate tool can read field-policy-protected fields

AshLua eval read operations can read field-policy-protected fields via aggregates

Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length

ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF

ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection