AIKIDO-2026-217972
ash is vulnerable to Attribute Injection
59
Medium Risk
This Affects:
ashTL;DR
Affected versions of Ash do not consistently filter private action arguments (public?: false) from user-supplied parameter maps, allowing attackers to set values intended for trusted server-side code. Applications that expose actions with private arguments to untrusted users may be vulnerable to integrity violations or privilege escalation if those arguments influence authorization, identity, or record ownership.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ash is vulnerable to Attribute Injection in versions 3.0.0 - 3.29.2.
How to fix this
Upgrade the ash library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant