AIKIDO-2026-898864
ash is vulnerable to Improper Neutralization of Special Elements in Data Query Logic
21
Low Risk
This Affects:
ashTL;DR
When a belongs_to relationship is managed with on_lookup: :relate, the client-supplied lookup value reaches the query filter without being cast to the attribute type. A nested map submitted where a scalar is expected is interpreted as a filter predicate, so an attacker can match a record without knowing its key, and recover that key from the response. The fix casts the lookup value to the attribute type and applies a single-row limit.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you manage a belongs_to relationship with on_lookup: :relate where the lookup value comes from user-controlled input.
Background info
ash is vulnerable to Improper Neutralization of Special Elements in Data Query Logic in versions 1.53.0 - 3.31.0.
How to fix this
Upgrade the ash library to the patch version.
Links
Other
github.com/ash-project/ash/blob/v3.31.1/CHANGELOG.md#v3311-2026-08-09
cna.erlef.org/cves/CVE-2026-70395.htmlosv.dev/vulnerability/EEF-CVE-2026-70395
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant