CVE-2026-77950 | CVSS: N/A
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match.
apply_error_handler/3 in lib/ash_typescript/rpc/errors.ex is the only hook an application has for redacting or suppressing errors before they reach the client, with a nil return dropping the error entirely. Its rescue clause logs a warning and then returns the original, pre-handler error map. Error handlers are conventionally written as patte
参考链接:
• https://cna.erlef.org/cves/CVE-2026-77950.html
• https://github.com/ash-project/ash_typescript/commit/59d8e985a98cf2e01794dbe5b91
• https://github.com/ash-project/ash_typescript/security/advisories/GHSA-mjr7-r3rf
📌 数据来源: NVD 官方