CVE-2026-77850
Received Received - Intake

Stored XSS in ash_admin via Unsanitized Record Labels

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: EEF

Description
Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser. The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in <b> tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record's label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as <img src=x onerror=...> runs as JavaScript in the admin's session as soon as a matching record appears in the dropdown, giving the attacker the admin's privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup. This issue affects ash_admin: from 0.13.0 before 1.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-77850
EUVD
EUVD-2026-68326

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_admin From 0.13.0 (inc) to 1.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77850 is a stored cross-site scripting (XSS) vulnerability in the AshAdmin library. It affects relationship typeahead components where user-supplied record labels are rendered without proper escaping in the admin interface. When an admin searches for a record, the unescaped label content is wrapped in HTML tags and executed as script using Phoenix.HTML.raw/1. This allows attackers to inject malicious scripts, such as an image tag with an onerror handler, into labels. When the admin views the dropdown, the script runs in their browser, potentially granting the attacker admin privileges.

Detection Guidance

To detect this vulnerability, inspect AshAdmin relationship typeahead components for improperly escaped user-supplied label fields. Check if Phoenix.HTML.raw/1 is used without prior HTML escaping in AshAdmin.Components.Resource.RelationshipField or AshAdmin.Components.Resource.ManagedRelationshipSelectField. Review database records for suspicious content in label fields that could contain script tags or event handlers.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in an administrator's browser session. If exploited, it could lead to full compromise of the admin interface, unauthorized access to sensitive data, or complete control over AshAdmin functionality. Attackers with lower privileges could escalate to admin-level access, potentially affecting all exposed system features.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. A successful exploit may result in data breaches, triggering mandatory breach notifications and potential fines under these regulations. The risk of privilege escalation further compromises access controls, which are critical for compliance.

Mitigation Strategies

Immediately upgrade AshAdmin to version 1.3.1 or later. If upgrading is not possible, apply the patch from the official commit 07289191ccdac27dd70ab7c6413ed057bc7fdade which HTML-escapes relationship typeahead labels before highlighting. Temporarily disable AshAdmin's relationship typeahead features if an upgrade cannot be performed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77850. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart