Improper Input Handling in Ash Project Affects User Data Integrity

CVE-2026-55736

What is CVE-2026-55736?

The Ash Project contains a vulnerability that allows for improper control of modification of dynamically-determined object attributes. Due to incomplete filtering of user-supplied parameters, an attacker can manipulate private action arguments—initially intended to be set by trusted server-side code. This flaw means that private arguments, which should be internally set only, can be altered through user input when keys are binary (string). Consequently, this can lead to critical integrity violations or privilege escalation, depending on how applications utilize these parameters. This issue affects versions of Ash from 3.0.0 up to, but not including, 3.29.3.

References