Executive brief
AshTypeScript is a library that bridges Ash (a data layer framework) with TypeScript/HTTP APIs. A flaw in request handling allows attackers to bypass input validation constraints—such as allowlists, length limits, and value ranges—by submitting requests directly over HTTP, bypassing TypeScript type checking. This can lead to privilege escalation, state-machine bypass, or unauthorized access when constraints guard roles, statuses, or permissions.
Technical details
The vulnerability is improper input validation in AshTypeScript's TypedController.RequestHandler. The code calls Ash.Type.cast_input/3 and treats a successful cast result as fully validated, but omits the subsequent step of calling Ash.Type.apply_constraints/3, which enforces constraints like one_of (allowlists), max_length, min/max bounds, and match patterns. Constraints such as allow_nil?: false are also bypassed, permitting empty strings for required arguments. An unauthenticated remote attacker can submit HTTP requests with out-of-bounds argument values; TypeScript client validation appears to enforce constraints but HTTP clients (curl, direct API calls) can bypass it. Where constraints gate role-based access, status transitions, or sort directions, this enables privilege escalation or state-machine attacks. The issue affects versions 0.15.0 through 0.17.x; a fix is available in 0.18.0 or later.
Affected products
- ash-project ash_typescript 0.15.0 before 0.18.0
Timeline
- 2026-09-01: disclosed