AIKIDO-2026-804798
ash_typescript is vulnerable to Incorrect Authorization
82
High Risk
This Affects:
ash_typescriptTL;DR
The RPC result processor drops Ash ForbiddenField markers on template driven paths, but normalize_primitive/1 has no clause for them. When an action returns an embedded resource as a map, a forbidden field reaches the generic struct branch, which calls Map.from_struct/1 and serializes every key including original_value, so an RPC caller can read attribute values that field policies were configured to deny. The fix redacts ForbiddenField and NotLoaded markers during primitive normalization.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you expose AshTypescript RPC endpoints that rely on Ash field policies to hide embedded resource attributes.
Background info
ash_typescript is vulnerable to Incorrect Authorization in versions 0.11.0 - 0.17.3.
How to fix this
Upgrade the ash_typescript library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.