AIKIDO-2026-33375
ash is vulnerable to SQL Injection
75
High Risk
This Affects:
ashTL;DR
Ash keyset pagination decodes a client-supplied cursor and splices a decoded element into a query filter without confirming it is a scalar sort value. A forged page[:after] or page[:before] cursor can carry a serialized Ash expression term such as a fragment call, which passes the filter builder. On the AshPostgres data layer the injected expression compiles to SQL, while on the ETS and Simple data layers it is evaluated as an arbitrary function call, and no authentication is needed to reach a paginated read action. The fix rejects any deserialized cursor term recognized as an Ash expression before it reaches the filter.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you expose a read action with keyset pagination whose cursor is populated from client-supplied input.
Background info
ash is vulnerable to SQL Injection in versions 1.17.0 - 3.31.2.
How to fix this
Upgrade the ash library to the patch version.
Links
Other
github.com/ash-project/ash/blob/v3.31.3/CHANGELOG.md#v3313-2026-08-12
cna.erlef.org/cves/CVE-2026-67579.htmlosv.dev/vulnerability/EEF-CVE-2026-67579
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant