CVE-2026-77950
Received Received - Intake

Information Disclosure in ash_typescript via Error Handler

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. apply_error_handler/3 in lib/ash_typescript/rpc/errors.ex is the only hook an application has for redacting or suppressing errors before they reach the client, with a nil return dropping the error entirely. Its rescue clause logs a warning and then returns the original, pre-handler error map. Error handlers are conventionally written as pattern-matching functions over expected error shapes, so an unmatched shape raises FunctionClauseError and the raw transformed error, including any secrets carried in vars, is emitted instead. An intent to suppress an error becomes an intent to publish it. The rescue catches exceptions only, so a handler that throws or exits still propagates. This issue affects ash_typescript: from 0.8.0 before 0.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-77950
EUVD
EUVD-2026-68925

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_typescript From 0.8.0 (inc) to 0.18.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77950 is a vulnerability in the ash_typescript library (versions 0.8.0 to 0.18.0) where unauthenticated attackers can receive unredacted internal error messages. When an error does not match the configured error handler's pattern, the system exposes the original error map, including sensitive data like secrets in variables. The error handler's rescue clause only catches exceptions, so errors thrown or exited from the handler still propagate raw data.

Detection Guidance

Check if your system uses ash_typescript versions 0.8.0 to 0.18.0 by inspecting package dependencies or running commands like 'npm list ash_typescript' or 'mix deps' for Elixir projects. Monitor error logs for unredacted error messages containing sensitive data, especially from RPC endpoints. Look for FunctionClauseError exceptions in logs as they indicate unmatched error handler patterns.

Impact Analysis

This vulnerability allows attackers to obtain sensitive internal error data, including secrets carried in error variables. Applications exposing AshTypescript RPC endpoints with custom error handlers are at risk. Attackers can provoke errors that don't match handler patterns, causing the system to return raw error details. This could lead to unauthorized disclosure of confidential information.

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by exposing sensitive personal or health data through unredacted error messages. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. Unauthorized disclosure of such data may result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade ash_typescript to version 0.18.0 or later immediately. If custom error handlers are used, review their patterns to ensure all error shapes are covered. Remove or disable RPC endpoints exposing error details until patched. Implement fail-closed error handling to prevent raw error exposure during handler failures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77950. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart