String Comparison Vulnerability in Ash SQL by Ash Project

CVE-2026-80227

What is CVE-2026-80227?

The vulnerability in Ash SQL allows users to bypass trimmed uniqueness and equality checks in the database by padding string fields with non-space whitespace characters such as tabs and newlines. This occurs due to the insufficient regex configuration in the string_trim/1 function, which only removes literal spaces, resulting in different behaviors based on whether the evaluation occurs in memory or in SQL. This inconsistency can lead to near-duplicate values being improperly registered, undermining data integrity.

References