Executive brief
ash_sql is a library used within the Ash framework to interact with SQL databases. A flaw in the string_trim function causes it to remove only spaces in SQL queries, while removing all whitespace characters in Elixir—allowing attackers to bypass uniqueness checks and equality validations by padding strings with tabs, newlines, or carriage returns. This could enable duplicate records to be inserted or filtered comparisons to be bypassed.
Technical details
The vulnerability is an incorrect comparison bug in the string_trim/1 function of ash_sql. The root cause is that the generated REGEXP_REPLACE SQL pattern interprets \s as a literal space character (codepoint 32) rather than a regex whitespace class, whereas Elixir's String.trim/1 removes all whitespace including tabs, newlines, carriage returns, and form feeds. This inconsistency allows an attacker to craft padded input that passes a trimmed uniqueness or equality check when evaluated in SQL but would fail in Elixir memory, or vice versa. Any Ash filter, validation, or identity constraint relying on string_trim/1 is affected. The vulnerability affects ash_sql versions 0.1.0 through 0.7.0; a patch is available in version 0.7.1.
Affected products
- ash-project ash_sql 0.1.0 to 0.7.0
Timeline
- 2026-08-30: disclosed