CVE-2026-77956
Received Received - Intake

Code Injection in ash_ai for Elixir

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: EEF

Description
Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -> ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as <%= System.cmd(...) %> therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated. This issue affects ash_ai: from 0.1.0 before 1.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-77956
EUVD
EUVD-2026-68303

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_ai From 0.1.0 (inc) to 1.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77956 is a critical code injection vulnerability in the AshAi library (versions 0.1.0 to below 1.0.0). It allows remote, unauthenticated attackers to execute arbitrary Elixir code on the server by injecting malicious code into prompt actions. The issue occurs because the AshAi.Actions.Prompt module improperly evaluates user-supplied prompt content as EEx templates, which are then compiled and executed as Elixir source code.

Detection Guidance

Check if your system runs ash_ai versions between 0.1.0 and below 1.0.0. Inspect HTTP endpoints using prompt actions for unexpected input processing. Look for logs showing EEx.eval_string/2 calls with user-controlled data. Monitor for unusual Elixir code execution patterns or commands like System.cmd in logs.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on the server without authentication. This could lead to complete system compromise, data theft, unauthorized access, or disruption of services. Attackers could run commands like <%= System.cmd(...) %> to take control of the server.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized code execution and potential data breaches. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A successful exploit could lead to unauthorized access to sensitive data, resulting in legal penalties and reputational damage.

Mitigation Strategies

Upgrade ash_ai to version 1.0.0 or later immediately. Disable or restrict access to prompt actions until patched. Review and sanitize all user input used in prompts. Implement network-level controls to block unauthorized access to vulnerable endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77956. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart