CVE-2026-82586
Description
Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's operation aggregate path in AshLua.Runtime took the field name straight from the Lua call and resolved it with only String.to_existing_atom and Ash.Query.Aggregate.new!, neither of which consults the exposed-field allow-list the normal fields path enforces. A script can therefore read the value of any attribute of any record the actor may read, including private sensitive?: true columns, via resource.read({ operation = {"list", "hashed_password"} }); min and max give a value oracle. Anyone able to submit or influence a Lua script can reach this. This issue affects ash_lua: from 0.1.0 before 0.2.1.
How to fix
- ash-project ash_lua0.2.1, c0dfcd9494766d548178c37df0bd01cff378e1c7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ash-project ash_lua | 0.1.0 ≤ v < 0.2.1, 8675e47cca81f36594083a7e63379bac9e123e72 ≤ v < c0dfcd9494766d548178c37df0bd01cff378e1c7 | 0.2.1, c0dfcd9494766d548178c37df0bd01cff378e1c7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.