CVE-2026-105283
Received Received - Intake

Information Disclosure in ash_typescript via RPC Error Response

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: EEF

Description
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for. AshTypescript.Rpc.ErrorBuilder.build_error_response/1 in lib/ash_typescript/rpc/error_builder.ex renders a pipeline error term that matches no specific clause with inspect/1 and places the result in details.error of the client-facing error. Ash exceptions take a separate path in AshTypescript.Rpc.Errors where unhandled cases are redacted behind an errorId, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where cast_map_to_struct/2 in lib/ash_typescript/rpc/input_formatter.ex throws the raw Ash.Type cast error into the builder, and field selection on a generic action that returns a primitive, where format_field_type/1 inspects the full Ash.Info.Manifest.Type struct into vars.returnType. Resource module names in vars.resource are not treated as sensitive and are out of scope. This issue affects ash_typescript: from 0.1.0 before 0.19.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-105283
EUVD
EUVD-2026-97336

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ash-project ash_typescript 0.1.0
ash-project ash_typescript 8e204ce34e24a158cf22a2dac4d53c44716c9e30

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ash_typescript (versions 0.1.0 to 0.19.0) allows unauthenticated attackers to read internal Elixir terms from RPC error responses. When the error builder processes unhandled errors, it exposes sensitive information by inspecting raw terms like Ash.Type cast errors or Ash.Info.Manifest.Type structs. Two attack paths exist: sending malformed struct-typed arguments in actions or requesting fields on generic actions with primitive return types.

Detection Guidance

To detect this vulnerability, monitor RPC error responses for exposed internal Elixir terms. Check if error messages contain raw structs or type information, particularly when handling malformed struct-typed arguments or generic action field requests. Review server logs for error responses containing terms like Ash.Type cast errors or Ash.Info.Manifest.Type.

Impact Analysis

An attacker could exploit this to read internal server-side details, potentially exposing sensitive data or application logic. This could lead to further attacks like data breaches or unauthorized access if combined with other vulnerabilities. The impact depends on the exposed terms and application context.

Mitigation Strategies

Immediately upgrade ash_typescript to version 0.19.1 or later. Ensure all RPC endpoints are updated to use the patched error handling. Review and update error response configurations to prevent raw term inspection. Monitor error logs for unredacted internal terms as a sign of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105283. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart