Is CVE-2026-82732 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82732 being exploited in the wild.

How severe is CVE-2026-82732?

Informational severity, with a CVSS score of 7.5, published 1 September 2026.

Which products and versions are affected?

Ash-Project Ash Typescript 0.15.0 before 0.18.0.

Is there a fix for CVE-2026-82732?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82732 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82732?

Check whether you run Ash-Project Ash Typescript at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82732: ash-project ash_typescript input validation bypass in TypedController

CVE-2026-82732 · Severity: info · CVSS 7.5 · Published 2026-09-01

AshTypeScript is a library that bridges Ash (a data layer framework) with TypeScript/HTTP APIs. A flaw in request handling allows attackers to bypass input validation constraints—such as allowlists, length limits, and value ranges—by submitting requests directly over HTTP, bypassing TypeScript type checking. This can lead to privilege escalation, state-machine bypass, or unauthorized access when constraints guard roles, statuses, or permissions.

Technologies: Ash-Project Ash Typescript. Vendors: Ash-Project.

Quick answers

Is CVE-2026-82732 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82732 being exploited in the wild.
How severe is CVE-2026-82732?: Informational severity, with a CVSS score of 7.5, published 1 September 2026.
Which products and versions are affected?: Ash-Project Ash Typescript 0.15.0 before 0.18.0.
Is there a fix for CVE-2026-82732?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82732 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82732?: Check whether you run Ash-Project Ash Typescript at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is improper input validation in AshTypeScript's TypedController.RequestHandler. The code calls Ash.Type.cast_input/3 and treats a successful cast result as fully validated, but omits the subsequent step of calling Ash.Type.apply_constraints/3, which enforces constraints like one_of (allowlists), max_length, min/max bounds, and match patterns. Constraints such as allow_nil?: false are also bypassed, permitting empty strings for required arguments. An unauthenticated remote attacker can submit HTTP requests with out-of-bounds argument values; TypeScript client validation appears to enforce constraints but HTTP clients (curl, direct API calls) can bypass it. Where constraints gate role-based access, status transitions, or sort directions, this enables privilege escalation or state-machine attacks. The issue affects versions 0.15.0 through 0.17.x; a fix is available in 0.18.0 or later.

Affected products

ash-project ash_typescript 0.15.0 before 0.18.0

Timeline

2026-09-01: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.