Executive brief
ash_ai is an Elixir library that integrates AI models into applications. A critical flaw allows remote attackers without authentication to execute arbitrary code on the server by injecting malicious Elixir expressions into prompt actions. This could lead to complete system compromise, data theft, or service disruption.
Technical details
The vulnerability is a code injection flaw in AshAi.Actions.Prompt, which uses EEx.eval_string/2 to evaluate prompt content. When prompt templates are built from user-supplied input (e.g., through the prompt: fn input, context -> ... end pattern), attacker-controlled data is compiled and executed as Elixir source code before any model request is made. An attacker can embed expressions like <%= System.cmd(...) %> to run arbitrary commands. No authentication is required—only network access to a prompt action endpoint. The fix restricts EEx evaluation to statically configured templates only, preventing dynamic compilation of user input.
Affected products
- ash-project ash_ai 0.1.0 before 1.0.0
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fix available in version 1.0.0 and later