Improper Input Validation in Ash Project by Ash

CVE-2026-82752

What is CVE-2026-82752?

An improper input validation vulnerability in Ash Project's Ash product allows an attacker to store an arbitrary value in a length-constrained attribute. The vulnerability arises from the way string lengths are measured using Unicode graphemes instead of a more conventional approach that aligns with the underlying data storage constraints. As a result, this can enable an attacker to bypass defined maximum lengths, potentially leading to excessive data being stored, which risks exploiting system storage capacity limitations. This mismatch between counting methods may result in data acceptance by Ash, while being rejected or truncated by the actual database storage layer, such as Postgres. This creates opportunities for unintended data persistence that can be exploited.

References