Executive brief
AshLua is a library that exposes Ash resources (a data abstraction framework) to Lua scripts with access controls defined via an allow-list of exposed fields. An attacker with the ability to submit or modify Lua scripts can bypass these access controls to read sensitive attributes—including private columns marked as sensitive—that should not be accessible, potentially exposing password hashes, encryption keys, and other protected data.
Technical details
The vulnerability is an improper access control bypass in the aggregation path of AshLua.Runtime. When processing read operations with aggregation (min/max), the code accepts field names directly from Lua and converts them via String.to_existing_atom and Ash.Query.Aggregate.new! without validating against the exposed-field allow-list that is enforced for normal field reads. An attacker can call resource.read({ operation = {"list", "hashed_password"} }) or similar to extract any attribute, including sensitive columns. The vulnerability affects ash_lua from version 0.1.0 before 0.2.1, and exploitation requires the ability to submit or influence a Lua script passed to the runtime.
Affected products
- ash-project ash_lua 0.1.0 before 0.2.1
Timeline
- 2026-09-07: disclosed