CVE-2026-75760 | CVSS: N/A
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-facing validation error.
In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message inspected the raw error term (An error occurred while generating embeddings: #{inspect(error)}). A plain-string add_error produces an Ash.Error.Changes.InvalidChanges in the :invalid class, which AshJsonApi and AshGraphql render back to the caller. The embedding client's error term is not sanitized, s
参考链接:
• https://cna.erlef.org/cves/CVE-2026-75760.html
• https://github.com/ash-project/ash_ai/commit/088a2562e16d65f36cec178070de6836364
• https://github.com/ash-project/ash_ai/security/advisories/GHSA-p5cr-mmmf-6w39
📌 数据来源: NVD 官方