CVE-2026-119613 · Package
NO FIX YET · SEE WHAT TO DO
When an AshAi tool call fails, ash_ai returns the raw internal error text to the caller, including module names and data values. A caller of an AshAi tool can read those internals just by triggering a failure.
first public Nov 7, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that depend on ash_ai from 1.5.0 before 1.5.1 and expose AshAi tools or the MCP server to callers, including AI models that call those tools. Exposure depends on whether untrusted callers can trigger tool failures, which the sources do not detail further.
Not affected if no-ash-ai-tools-exposed, version-1.5.1-or-later
Who cares ash, ash-ai, elixir, mcp
ash_ai version in mix.lock or mix.exs; affected versions are from 1.5.0 before 1.5.1.AshAi.Mcp.Server) exposed to callers outside the trusted team.ash_ai 1.5.1 (the fix logs errors under an error id and returns only that id to the caller).Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail.
AshAi.ToToolError gained an implementation for Ash.Error.Unknown.UnknownError that returns the error's error field as is, and AshAi.Tool.Errors.format/1 sends that text to MCP clients (tool calls and resource reads in AshAi.Mcp.Server) and to the model in AshAi.ToolLoop. Ash stores the full Exception.format/2 output of a raised exception, or inspect/1 of a bare {:error, term} return, in that field. A tool result that cannot be JSON-encoded raises a Protocol.UndefinedError whose text includes the inspected value, which can be a whole record with fields the tool never returns. None of these errors were logged. The fix logs them under an error id and returns only that id to the caller.
This issue affects ash_ai: from 1.5.0 before 1.5.1.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.