Executive brief
Ash is a data modeling framework used in Elixir applications. A vulnerability in its case-insensitive string type allows an attacker to store data that violates length or pattern constraints by exploiting a validation-order flaw. An attacker can submit uppercase text that passes validation but gets stored in lowercase form, bypassing rules that explicitly reject lowercase versions of the same text.
Technical details
The vulnerability is an incorrect behavior order (validate before canonicalize) in Ash.Type.CiString.apply_constraints/2. The function validates max_length, min_length, and match constraints against the original (unfolded) string, but then case-folds the string for storage. An attacker can submit a string whose case-folded form violates a constraint but whose original form passes validation. For example, an uppercase string matching a required uppercase pattern can be submitted; it passes validation, but is stored lowercased, persisting data the pattern explicitly rejects. The fix applies case-folding before constraint validation. This affects ash versions 1.29.0-rc0 through 3.32.1 and requires upgrading to 3.32.2 or later.
Affected products
- ash-project ash 1.29.0-rc0 to 3.32.1
Timeline
- 2026-09-01: disclosed