CVE-2026-77956
Description
Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -> ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as <%= System.cmd(...) %> therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated. This issue affects ash_ai: from 0.1.0 before 1.0.0.
How to fix
- ash-project ash_ai1.0.0, e9948254b5659c1143b73dc2f59f457931e64514 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ash-project ash_ai | 0.1.0 ≤ v < 1.0.0, 4aab131d40a0bd5a8cf0b3c4eaaa59d49565f3d1 ≤ v < e9948254b5659c1143b73dc2f59f457931e64514 | 1.0.0, e9948254b5659c1143b73dc2f59f457931e64514 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.