CVE-2026-77850: Stored XSS in AshAdmin relationship typeahead via unescaped label_field content
Stored Cross-site Scripting vulnerability in ash-project ashadmin executes attacker-supplied record content as script in an administrator's browser.
The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in <b> tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record's labelfield, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as <img src=x onerror=...> runs as JavaScript in the admin's session as soon as a matching record appears in the dropdown, giving the attacker the admin's privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.
This issue affects ashadmin: from 0.13.0 before 1.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project/ash_adminto a version that resolves this vulnerability.Fixed in 1.3.1 - Configuration
In RelationshipField, HTML-escape the destination record label_field before inserting the highlight markup; avoid rendering the full highlighted string with Phoenix.HTML.raw/1 (which disables output escaping for the entire string).
AshAdmin.Components.Resource.RelationshipField Phoenix.HTML.raw/1 usage in highlighted label rendering = remove raw/1; HTML-escape label_field before inserting highlight markup - Configuration
In ManagedRelationshipSelectField, HTML-escape the destination record label_field before inserting the highlight markup; avoid rendering the whole highlighted string with Phoenix.HTML.raw/1 (which disables output escaping for the entire string).
AshAdmin.Components.Resource.ManagedRelationshipSelectField Phoenix.HTML.raw/1 usage in highlighted label rendering = remove raw/1; HTML-escape label_field before inserting highlight markup
Event History
Frequently Asked Questions
Which deployments are affected?
AshAdmin versions from 0.13.0 up to, but not including, 1.3.1 are affected when the relationship typeahead components are used. The affected components are AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField.
What must an attacker be able to do to exploit this issue?
The attacker needs to store crafted HTML in the destination record's configured label_field. This content is often ordinary database data that may be writable by lower-privileged users; the payload executes when an administrator sees a matching record in the relationship dropdown.
How can administrators determine whether malicious content may already be present?
Review destination records used by relationship typeaheads for label_field values containing HTML or script-capable markup, such as an img element with an onerror handler. Any such stored value could execute in an administrator's browser when returned as a matching dropdown result.
What is the remediation?
Upgrade ash_admin to version 1.3.1 or later. The fix HTML-escapes the label value before adding the search-term highlight markup.