AIKIDO-2026-523350
ash_ai is vulnerable to Information Disclosure
53
Medium Risk
This Affects:
ash_aiTL;DR
When a tool raises during execution, AshAi.ToolLoop serializes the raw exception message and returns it as tool-result content within the conversation and to the model provider. Sensitive internal details such as database table and column names, query fragments, and policy internals can leak through these messages. A user can steer the model into calling tools with arguments that trigger exceptions to extract that information. The fix routes raised tool errors through a safe formatter instead of exposing raw messages.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you expose tools whose exceptions can be triggered by untrusted chat input.
Background info
ash_ai is vulnerable to Information Disclosure in versions 0.6.0 - 0.8.2.
How to fix this
Upgrade the ash_ai library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.