CVE-2026-77850
Description
Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser. The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in <b> tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record's label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as <img src=x onerror=...> runs as JavaScript in the admin's session as soon as a matching record appears in the dropdown, giving the attacker the admin's privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup. This issue affects ash_admin: from 0.13.0 before 1.3.1.
How to fix
- ash-project ash_admin1.3.1, 07289191ccdac27dd70ab7c6413ed057bc7fdade or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ash-project ash_admin | 0.13.0 ≤ v < 1.3.1, eb940f4d7d857ca49368ae847f586d01c6f5ad35 ≤ v < 07289191ccdac27dd70ab7c6413ed057bc7fdade | 1.3.1, 07289191ccdac27dd70ab7c6413ed057bc7fdade |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.