https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 08:48:30 +0000 https://cve.radiocsirt.org/vuln/cve-2026-77850 <p><strong>Affected:</strong> ash-project ash_admin</p> <p>Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator&#39;s browser.</p> <p>The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in &lt;b&gt; tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record&#39;s label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as &lt;img src=x onerror=...&gt; runs as JavaScript in the admin&#39;s session as soon as a matching record appears in the dropdown, giving the attacker the admin&#39;s privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.</p> <p>This issue affects ash_admin: from 0.13.0 before 1.3.1.</p> <p><strong>Affected:</strong> ash-project ash_admin</p> <p>Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator&#39;s browser.</p> <p>The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in &lt;b&gt; tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record&#39;s label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as &lt;img src=x onerror=...&gt; runs as JavaScript in the admin&#39;s session as soon as a matching record appears in the dropdown, giving the attacker the admin&#39;s privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.</p> <p>This issue affects ash_admin: from 0.13.0 before 1.3.1.</p> https://cve.radiocsirt.org/vuln/cve-2026-77850