# CVE-2026-80227: ash-project ash_sql string trim incorrect comparison

Source: https://junglewise.ai/threats/cve-2026-80227-ash-project-ash-sql-string-trim-incorrect-comparison  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-80227 · Severity: info · Published 2026-08-30

ash_sql is a library used within the Ash framework to interact with SQL databases. A flaw in the string_trim function causes it to remove only spaces in SQL queries, while removing all whitespace characters in Elixir—allowing attackers to bypass uniqueness checks and equality validations by padding strings with tabs, newlines, or carriage returns. This could enable duplicate records to be inserted or filtered comparisons to be bypassed.

Technologies: [Ash-Project Ash Sql](https://junglewise.ai/threats/technologies/ash-sql). Vendors: [Ash-Project](https://junglewise.ai/threats/vendors/ash-project).

## Quick answers

**Is CVE-2026-80227 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80227 being exploited in the wild.

**How severe is CVE-2026-80227?** Informational severity, published 30 August 2026.

**Which products and versions are affected?** Ash-Project Ash Sql 0.1.0 to 0.7.0.

**Is there a fix for CVE-2026-80227?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-80227 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-80227?** Check whether you run Ash-Project Ash Sql at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an incorrect comparison bug in the string_trim/1 function of ash_sql. The root cause is that the generated REGEXP_REPLACE SQL pattern interprets \s as a literal space character (codepoint 32) rather than a regex whitespace class, whereas Elixir's String.trim/1 removes all whitespace including tabs, newlines, carriage returns, and form feeds. This inconsistency allows an attacker to craft padded input that passes a trimmed uniqueness or equality check when evaluated in SQL but would fail in Elixir memory, or vice versa. Any Ash filter, validation, or identity constraint relying on string_trim/1 is affected. The vulnerability affects ash_sql versions 0.1.0 through 0.7.0; a patch is available in version 0.7.1.

## Affected products

- ash-project ash_sql 0.1.0 to 0.7.0

## Timeline

- 2026-08-30: disclosed

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)

## Related threats

- [ash-project ash_sql authorization bypass in aggregates](https://junglewise.ai/threats/cve-2026-81318-ash-project-ash-sql-authorization-bypass-in-aggregates)
- [ash-project ash_sql incorrect authorization in aggregate queries](https://junglewise.ai/threats/cve-2026-81316-ash-project-ash-sql-incorrect-authorization-in-aggregate-queries)
- [ash-project ash_sql LIKE wildcard injection in string search](https://junglewise.ai/threats/cve-2026-78691-ash-project-ash-sql-like-wildcard-injection-in-string-search)
- [ash-project ash_sql authorization bypass in exists filter](https://junglewise.ai/threats/cve-2026-77454-ash-project-ash-sql-authorization-bypass-in-exists-filter)