CVE-2026-82732 | CVSS: N/A
Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes.
AshTypescript.TypedController.RequestHandler in lib/ash_typescript/typed_controller/request_handler.ex calls Ash.Type.cast_input/3 and treats an {:ok, cast} result as fully validated. In Ash these are separate steps: cast_input/3 only coerces the term, while every constraint declared on the argument is applied by Ash.Type.apply_constraints/3, which this path never calls. Constraints such as one_of, max_length
参考链接:
• https://cna.erlef.org/cves/CVE-2026-82732.html
• https://github.com/ash-project/ash_typescript/commit/21ab6f1229a4dccdb56bc37ed43
• https://github.com/ash-project/ash_typescript/security/advisories/GHSA-f7fq-hwq6
📌 数据来源: NVD 官方