AIKIDO-2026-308240

TL;DR

AshAdmin builds row-action navigation links by interpolating a record's string primary key directly into the query string without URL-encoding it. A primary key value containing query-string metacharacters injects additional parameters into the generated link. Because later parameters win when the query string is parsed, the injected values can override the intended action an admin follows from the data table. The fix URL-encodes row-action link parameters.