Executive brief
AshAI is a library that provides AI-powered tool execution capabilities. A vulnerability in how it validates user identity allows an attacker with access to an identity-configured tool to modify or delete database records they should not have permission to access, potentially affecting entire tables of data.
Technical details
The vulnerability is an authorization bypass in AshAi.Tool.Execution's identity_filter/3 function, which constructs database filters from raw tool arguments without proper validation. Map values in filter arguments are interpreted as predicate expressions rather than literal values, allowing attackers to inject operators like "not_eq" to retarget updates or deletes at unintended records. Combined with Ash.Query.limit(1) and bulk write operations, an attacker can modify or destroy rows they never identified. The fix casts identity values to their field type and rejects non-scalar inputs. The vulnerability affects versions 0.6.0 through 1.0.0 (exclusive) and requires network access to a tool endpoint.
Affected products
- ash-project ash_ai 0.6.0 before 1.0.0
Timeline
- 2026-08-31: disclosed