Error Message Disclosure Vulnerability in AshAi by Ash Project
CVE-2026-119613

5.3MEDIUM

Key Information:

Vendor

Ash-project

Status
Ash Ai
Vendor
CVE Published:
9 November 2026

What is CVE-2026-119613?

A vulnerability in the AshAi tool allows unauthorized access to sensitive internal error messages. When an AshAi tool call fails, details such as module names and data values can be revealed, giving attackers potential insights into system configurations and functionality. Key errors are not logged, adding to the risk of sensitive information exposure. The vulnerability has been addressed in version 1.5.1, where error logging has been improved to safeguard sensitive details by returning only an error ID to the caller.

Affected Version(s)

ash_ai 1.5.0 < 1.5.1

ash_ai fbad04e9620ef70603f4e67e03f15092f58578f6

References

https://github.com/ash-project/ash_ai/security/advisories...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-119613.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-119613
related

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sebastian Seilund
Sebastian Seilund
Zach Daniel / Ash Project
Jonatan Männchen / EEF
.