AIKIDO-2026-986616
ash_typescript is vulnerable to Information Exposure Through an Error Message
63
Medium Risk
This Affects:
ash_typescriptTL;DR
The typed controller interpolates inspect(value, limit: 50) into the HTTP 500 response body when a route handler returns anything other than a %Plug.Conn{} struct. The limit option bounds elements per collection rather than the whole term, so an error tuple carrying a user record can serialize full field sets into the response, exposing hashed passwords, tokens, and tenant identifiers. Unlike other raised error paths this disclosure does not check the show-raised-errors setting. The fix only includes the unexpected return detail when that configuration is enabled.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you have typed controller route handlers that can return a non-connection term containing sensitive data.
Background info
ash_typescript is vulnerable to Information Exposure Through an Error Message in versions 0.15.0 - 0.17.3.
How to fix this
Upgrade the ash_typescript library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.