CVE-2026-82580 | CVSS: N/A
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat users.
In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content. That content is appended to the conversation, emitted as a {:tool_result, …} stream event, and sent back to the model, which typically relays it to the user. No filtering happened first, so anything raised inside a tool callback or lifecycle hook (database constraint messages, adapter errors, quer
参考链接:
• https://cna.erlef.org/cves/CVE-2026-82580.html
• https://github.com/ash-project/ash_ai/commit/c68dfbdb220426dc015b58379e95bde8e9f
• https://github.com/ash-project/ash_ai/security/advisories/GHSA-5747-6mpw-6m9c
📌 数据来源: NVD 官方