CVE-2026-105283

6.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-209

Impact

Unauthenticated remote attackers can read internal Elixir terms and struct data exposed in RPC error responses. They only need network access to reach exposed RPC endpoints with malformed requests.

Root cause

The RPC error builder falls back to calling inspect/1 on unhandled pipeline error terms without redaction, placing raw internal data directly into client-facing responses.

Affected systems

ash_typescript from 0.1.0 before 0.19.1

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade ash_typescript to 0.19.1 or later. No interim workaround is documented; prioritize patching the dependency.

shell

$ mix deps.update ash_typescript

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for. AshTypescript.Rpc.ErrorBuilder.build_error_response/1 in lib/ash_typescript/rpc/error_builder.ex renders a pipeline error term that matches no specific clause with inspect/1 and places the result in details.error of the client-facing error. Ash exceptions take a separate path in AshTypescript.Rpc.Errors where unhandled cases are redacted behind an errorId, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where cast_map_to_struct/2 in lib/ash_typescript/rpc/input_formatter.ex throws the raw Ash.Type cast error into the builder, and field selection on a generic action that returns a primitive, where format_field_type/1 inspects the full Ash.Info.Manifest.Type struct into vars.returnType. Resource module names in vars.resource are not treated as sensitive and are out of scope. This issue affects ash_typescript: from 0.1.0 before 0.19.1.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-105283