Is CVE-2026-82731 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82731 being exploited in the wild.

How severe is CVE-2026-82731?

Informational severity, with a CVSS score of 6.1, published 1 September 2026.

Which products and versions are affected?

Ash-Project Ash Typescript 0.15.0 before 0.18.0.

Is there a fix for CVE-2026-82731?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82731 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82731?

Check whether you run Ash-Project Ash Typescript at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82731: ash-project ash_typescript open redirect in typed controller routing

CVE-2026-82731 · Severity: info · CVSS 6.1 · Published 2026-09-01

ash_typescript is a code generation library for Ash web framework that creates TypeScript client code from Elixir backend definitions. An open redirect vulnerability allows attackers to craft malicious URLs that trick clients into sending authenticated requests to arbitrary external hosts, potentially exposing session credentials and sensitive data.

Technologies: Ash-Project Ash Typescript. Vendors: Ash-Project.

Quick answers

Is CVE-2026-82731 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82731 being exploited in the wild.
How severe is CVE-2026-82731?: Informational severity, with a CVSS score of 6.1, published 1 September 2026.
Which products and versions are affected?: Ash-Project Ash Typescript 0.15.0 before 0.18.0.
Is there a fix for CVE-2026-82731?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82731 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82731?: Check whether you run Ash-Project Ash Typescript at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an open redirect (CWE-601) in the route rendering code generation (lib/ash_typescript/typed_controller/codegen/route_renderer.ex). URL path parameters are interpolated directly without URL encoding via encodeURIComponent, allowing injection of path traversal sequences (../), URL fragments (#), query delimiters (?), or protocol-relative paths (//). A malicious path parameter value like /evil.example.com/x generates a protocol-relative URL that redirects authenticated fetch requests to an attacker-controlled host. The vulnerability affects generated client code with no runtime constraints—type checking is compile-time only and doesn't prevent malicious values. The query string path is unaffected as URLSearchParams.set properly encodes values.

Affected products

ash-project ash_typescript 0.15.0 before 0.18.0

Timeline

2026-09-01: disclosed
2026-09-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.