CVE-2026-82731
Received Received - Intake

Open Redirect in ash_typescript

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redirect a generated client's request, and the credentials attached to it, to an unintended route or an external origin. The URL builders in lib/ash_typescript/typed_controller/codegen/route_renderer.ex replace each :param placeholder with a bare template interpolation and never call encodeURIComponent, so the value reaches executeTypedControllerRequest raw. A value containing ../ is normalised away by the fetch URL resolver and reaches a different route, while ? or # truncates the path and can smuggle or override query parameters. For a route whose path begins with a parameter, a value such as /evil.example.com/x yields the protocol-relative URL //evil.example.com/x, sending the request and the credentials from TypedControllerConfig to an attacker-controlled host. Nothing constrains the value at runtime: get_path_param_type/2 emits only a TypeScript type, which is erased. The query-string path is unaffected, since URLSearchParams.set encodes its own values. This issue affects ash_typescript: from 0.15.0 before 0.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-82731
EUVD
EUVD-2026-68930

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ash-project ash_typescript to 0.18.0 (exc)
ash-project ash_typescript From 0.18.0 (inc)
ash-project ash_typescript From 0.15.0 (inc) to 0.18.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Open Redirect vulnerability in the AshTypescript library (versions 0.15.0 to 0.18.0). It occurs because URL builders replace path parameter placeholders with raw template interpolations without encoding them. Attackers can manipulate path parameters to redirect requests to unintended routes or external origins, potentially stealing credentials. For example, a value like /evil.example.com/x can create a protocol-relative URL //evil.example.com/x that sends requests to attacker-controlled hosts.

Detection Guidance

To detect this vulnerability, inspect TypeScript client code generated by ash_typescript versions 0.15.0 to 0.18.0 for unencoded path parameters in URL builders. Check for routes with path parameters at the beginning and verify if encodeURIComponent is missing in URL template generation. Look for protocol-relative URLs like //evil.example.com/x in network requests.

Impact Analysis

An attacker could trick users into visiting a malicious link that redirects their authenticated requests to an attacker-controlled server. This could lead to credential theft, session hijacking, or exposure of sensitive data sent with the request. The impact depends on whether the application uses routes with path parameters at the beginning and whether credentials are attached to requests.

Mitigation Strategies

Immediately upgrade ash_typescript to version 0.18.0 or later to apply the patch that encodes path parameters with encodeURIComponent. Alternatively, configure an absolute typed_controller_base_path to prevent protocol-relative URL redirection. Review and update any generated TypeScript clients to ensure path parameters are properly encoded.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82731. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart