Executive brief
Ash is a popular Elixir framework for building data-driven applications. A validation flaw allows attackers to bypass constraints on nested arrays (arrays within arrays), submitting invalid data such as oversized lists or lists containing null values where they are disallowed. This could lead to invalid data being persisted in the system, potentially causing application errors or data integrity issues.
Technical details
The vulnerability is an improper input validation flaw in Ash.Type.apply_constraints/3 (lib/ash/type/type.ex) affecting doubly-nested array type constraints. When processing {:array, {:array, type}} attributes, only inner array constraints are applied via mapping; outer array constraints (min_length, max_length, nil_items?) are never enforced. An attacker can submit outer lists that violate these constraints and have them accepted and persisted without validation error. The fix explicitly handles nil and non-list inputs and applies outer array constraints before processing inner constraints. Network reachability and authentication requirements depend on the application using Ash; however, the validation bypass is application-facing.
Affected products
- ash-project ash from 2.16.1 before 3.32.2
Timeline
- 2026-09-01: disclosed