CVE-2026-82732
Received Received - Intake

Improper Input Validation in ash_typescript

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes. AshTypescript.TypedController.RequestHandler in lib/ash_typescript/typed_controller/request_handler.ex calls Ash.Type.cast_input/3 and treats an {:ok, cast} result as fully validated. In Ash these are separate steps: cast_input/3 only coerces the term, while every constraint declared on the argument is applied by Ash.Type.apply_constraints/3, which this path never calls. Constraints such as one_of, max_length, min and max, and match are therefore inert, so a value outside a declared allowlist is accepted and passed to the route handler. Codegen renders the same constraints into the generated TypeScript types, so an allowlist appears enforced to a TypeScript caller while any other HTTP client ignores it. Empty-string to nil normalization also lives in apply_constraints, so the allow_nil?: false check accepts "" for a required argument. Where a constraint gates a role, a status, or a sort direction, this becomes a privilege or state-machine bypass. This issue affects ash_typescript: from 0.15.0 before 0.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-82732
EUVD
EUVD-2026-68927

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ash-project ash_typescript From 0.15.0 (inc) to 0.18.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Input Validation issue in the ash_typescript library. It occurs because the TypedController.RequestHandler only performs type coercion on input values but fails to enforce declared constraints like allowlists, length limits, or value bounds. This allows attackers to submit values outside intended ranges, bypassing security checks that should restrict inputs to valid options.

Detection Guidance

To detect this vulnerability, inspect your ash_typescript application for typed-controller routes with argument constraints. Check if the application uses versions 0.15.0 to 0.17.x. Verify if constraints like allowlists, max_length, or min/max are declared but not enforced by testing with invalid values.

Impact Analysis

This vulnerability can lead to privilege escalation, state-machine bypasses, or unauthorized actions if constraints gate roles, statuses, or sorting directions. Attackers can submit invalid values that bypass intended restrictions, potentially gaining unauthorized access or manipulating application behavior. The impact varies depending on how constraints are used in the application.

Mitigation Strategies
  • Upgrade ash_typescript to version 0.18.0 or later to apply the patch that enforces constraints.
  • Review typed-controller routes for arguments with constraints and validate that inputs are properly checked.
  • Test routes with invalid values to confirm constraints are enforced after upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82732. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart