https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 15:04:50 +0000 https://cve.radiocsirt.org/vuln/cve-2026-82727 <p><strong>Affected:</strong> ash-project ash_phoenix</p> <p>Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.</p> <p>When AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix&#39;s parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{&#34;_union_type&#34; =&gt; &#34;nope&#34;, &#34;password&#34; =&gt; &#34;...&#34;} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.</p> <p>This issue affects ash_phoenix: from 1.2.17 before 2.3.25.</p> <p><strong>Affected:</strong> ash-project ash_phoenix</p> <p>Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.</p> <p>When AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix&#39;s parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{&#34;_union_type&#34; =&gt; &#34;nope&#34;, &#34;password&#34; =&gt; &#34;...&#34;} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.</p> <p>This issue affects ash_phoenix: from 1.2.17 before 2.3.25.</p> https://cve.radiocsirt.org/vuln/cve-2026-82727