Deserialization of Untrusted Data Vulnerability in Ash Project

CVE-2026-67579

What is CVE-2026-67579?

The Ash Project suffers from a deserialization of untrusted data vulnerability that allows unauthenticated attackers to inject malicious filter expressions through a manipulated keyset pagination cursor. This issue arises when read actions with keyset pagination decode user-supplied cursors, consequently permitting the execution of SQL injections or arbitrary code dependent on the data layer used. The flaw originates in the way the Ash framework processes decoded cursor expressions without adequately applying necessary security checks, enabling attackers to bypass essential controls that would normally mitigate these types of exploits. Specifically, in the case of AshPostgres, the injected code becomes embedded in SQL queries, while with other data layers such as ETS and Simple, it executes as arbitrary function calls.

References