Executive brief
ash_typescript is a code generation library for Ash web framework that creates TypeScript client code from Elixir backend definitions. An open redirect vulnerability allows attackers to craft malicious URLs that trick clients into sending authenticated requests to arbitrary external hosts, potentially exposing session credentials and sensitive data.
Technical details
The vulnerability is an open redirect (CWE-601) in the route rendering code generation (lib/ash_typescript/typed_controller/codegen/route_renderer.ex). URL path parameters are interpolated directly without URL encoding via encodeURIComponent, allowing injection of path traversal sequences (../), URL fragments (#), query delimiters (?), or protocol-relative paths (//). A malicious path parameter value like /evil.example.com/x generates a protocol-relative URL that redirects authenticated fetch requests to an attacker-controlled host. The vulnerability affects generated client code with no runtime constraints—type checking is compile-time only and doesn't prevent malicious values. The query string path is unaffected as URLSearchParams.set properly encodes values.
Affected products
- ash-project ash_typescript 0.15.0 before 0.18.0
Timeline
- 2026-09-01: disclosed
- 2026-09-01: advisory