AIKIDO-2026-304338
ash_graphql is vulnerable to Information Disclosure
69
Medium Risk
This Affects:
ash_graphqlTL;DR
AshGraphql's error handling re-injects the original :path field via Map.put_new/3 after a configured error_handler runs. This reverses any sanitization the handler performed, including explicit deletion of the path. Because build_error_path/5 defaults to internal Ash field names when no GraphQL field mapping exists, validation failures on non-exposed attributes leak internal field identifiers to any client submitting a failing request. The fix stops re-attaching the error path after the handler executes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ash_graphql is vulnerable to Information Disclosure in versions 1.9.0 - 1.10.1.
How to fix this
Upgrade the ash_graphql library to the patch version.
Links
Other
github.com/ash-project/ash_graphql/blob/v1.11.0/CHANGELOG.md#v1110-2026-08-30
cna.erlef.org/cves/CVE-2026-78693.htmlosv.dev/vulnerability/EEF-CVE-2026-78693
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.