Error Message Exposure in Ash Typescript by Ash Project
CVE-2026-105283

6.3MEDIUM

Key Information:

Vendor

Ash-project

Status
Ash Typescript
Vendor
CVE Published:
12 October 2026

What is CVE-2026-105283?

A vulnerability in Ash Typescript allows unauthenticated attackers to gain access to sensitive internal Elixir terms through improperly constructed error messages. When the error builder encounters specific errors, it fails to redact these terms before sending them back in the HTTP or channel response. This can lead to inadvertent exposure of sensitive information contained within error messages when specific requests result in error conditions. It is crucial for users of ash_typescript prior to version 0.19.1 to assess their exposure and apply available updates.

Affected Version(s)

ash_typescript 0.1.0 < 0.19.1

ash_typescript 8e204ce34e24a158cf22a2dac4d53c44716c9e30 < 4b3c65203ee78dc992d6d2e6559625c5460a01cd

References

https://github.com/ash-project/ash_typescript/security/ad...
relatedvendor-advisory
https://cna.erlef.org/cves/CVE-2026-105283.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-105283
related

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Shoukry / Udin
Peter Shoukry / Udin
Torkild Gundersen Kjevik / Ash Project
Jonatan Männchen / EEF
.