Executive brief
ash_typescript is a TypeScript integration library for the Ash framework that processes HTTP requests. When a controller handler returns an unexpected value, the application returns a detailed error message containing sensitive data such as passwords, tokens, and tenant identifiers to unauthenticated users. This allows attackers to extract confidential information without authentication, posing a direct risk to account security and multi-tenant data isolation.
Technical details
This is an information disclosure vulnerability (CWE-209) in ash_typescript's request handler. When dispatch/3 in lib/ash_typescript/typed_controller/request_handler.ex encounters a return value that is not a %Plug.Conn{}, it passes the value to unexpected_return/2, which uses inspect(value, limit: 50) to serialize the value into the HTTP 500 response body. The limit option bounds collection elements rather than the entire term, causing nested structures like {:error, %User{}} or changesets to expose their full field sets, including hashed passwords and tokens. The vulnerability is unauthenticated (no credentials required) and network-accessible. Notably, the module gates Exception.message/1 behind a feature flag elsewhere, but this code path is ungated and always echoes sensitive data. The issue affects versions 0.15.0 through 0.17.x; version 0.18.0 and later include a fix.
Affected products
- ash-project ash_typescript 0.15.0 to 0.17.x
Timeline
- 2026-09-01: disclosed