Quick answers
- Is CVE-2026-82733 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82733 being exploited in the wild.
- How severe is CVE-2026-82733?
- Informational severity, with a CVSS score of 7.5, published 1 September 2026.
- Which products and versions are affected?
- Ash-Project Ash Typescript 0.15.0 to 0.17.x.
- Is there a fix for CVE-2026-82733?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82733 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-82733?
- Check whether you run Ash-Project Ash Typescript at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is an information disclosure vulnerability (CWE-209) in ash_typescript's request handler. When dispatch/3 in lib/ash_typescript/typed_controller/request_handler.ex encounters a return value that is not a %Plug.Conn{}, it passes the value to unexpected_return/2, which uses inspect(value, limit: 50) to serialize the value into the HTTP 500 response body. The limit option bounds collection elements rather than the entire term, causing nested structures like {:error, %User{}} or changesets to expose their full field sets, including hashed passwords and tokens. The vulnerability is unauthenticated (no credentials required) and network-accessible. Notably, the module gates Exception.message/1 behind a feature flag elsewhere, but this code path is ungated and always echoes sensitive data. The issue affects versions 0.15.0 through 0.17.x; version 0.18.0 and later include a fix.
Affected products
- ash-project ash_typescript 0.15.0 to 0.17.x
Timeline
- 2026-09-01: disclosed