CVE-2026-105283 ash-project CVE debrief

Who should care

Defenders responsible for AshTypescript deployments, especially those with exposure to unauthenticated error responses, should assess and verify their exposure. This includes reviewing error handling and response mechanisms, and implementing compensating controls for exposed systems.

Why it matters

CVE-2026-105283 allows an unauthenticated attacker to read internal Elixir terms from an RPC error response. Defenders should verify exposure in AshTypescript deployments, especially where error responses may be accessible.

• Potential exposure of sensitive internal Elixir terms
• Possible unauthorized access to error responses
• Need for verification of AshTypescript deployments
• Potential impact on error handling and response mechanisms

Technical summary

A vulnerability in AshTypescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for. AshTypescript.Rpc.ErrorBuilder.build_error_response/1 in lib/ash_typescript/rpc/error_builder.ex renders a pipeline error term that matches no specific clause with inspect/1 and places the result in details.error of the client-facing error. This occurs when a struct-typed action argument has an invalid nested value or field selection on a generic action that returns a primitive.

Defensive priority

Defenders should prioritize verifying exposure in AshTypescript deployments, especially where error responses may be accessible to unauthenticated attackers.

Recommended defensive actions

• Verify AshTypescript deployments for exposure to unauthenticated error responses
• Assess the sensitivity of internal Elixir terms that may be exposed
• Review and update error handling and response mechanisms
• Implement compensating controls for exposed systems
• Monitor relevant logs for exposed assets
• Track exceptions and retest remediated assets
• Review vendor-supported updates or mitigations

Evidence notes

The CVE record and source item provide details on the vulnerability, but its impact and remediation require verification from official sources. Defenders should verify exposure in AshTypescript deployments, especially where error responses may be accessible to unauthenticated attackers. The vulnerability allows an unauthenticated attacker to read internal Elixir terms from an RPC error response.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.