AIKIDO-2026-893484
ash_cloak is vulnerable to Deserialization of Untrusted Data
59
Medium Risk
This Affects:
ash_cloakTL;DR
The decryption calculation turns decrypted column bytes back into an Elixir term using binary_to_term without the :safe option and without rejecting compressed payloads. Deserializing crafted bytes interns arbitrary atoms and can expand a compression bomb during decoding, before any validation runs. Anyone able to influence the stored ciphertext, for example when an unauthenticated cipher is used or the database contents can be modified, can exhaust the atom table or memory and permanently crash the BEAM node. The fix decodes terms with :safe, refuses compressed payloads, and loads values through the type's embedded storage representation.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and untrusted or externally modifiable data can reach an encrypted column's stored bytes, for example when an unauthenticated cipher such as Cloak.Ciphers.AES.CTR is used or the database contents can be altered.
Background info
ash_cloak is vulnerable to Deserialization of Untrusted Data in versions 0.1.0 - 0.3.1.
How to fix this
Upgrade the ash_cloak library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.