CVE-2026-77956: EEx template evaluation of prompt content in AshAi enables remote code execution
Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ashai allows a remote, unauthenticated client to execute arbitrary Elixir code.
AshAi.Actions.Prompt evaluates prompt content through EEx.evalstring/2. The documented prompt: fn input, context -> ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as <%= System.cmd(...) %> therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.
This issue affects ashai: from 0.1.0 before 1.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project/ash_aito a version that resolves this vulnerability.Fixed in 1.0.0 - Configuration
Update ash_ai so that prompt content supplied via actions (e.g., function-supplied prompt content built from action arguments such as request data) is no longer evaluated as EEx via EEx.eval_string/2; only statically configured templates should be evaluated.
AshAi (ash_ai) EEx.eval_string/2 usage for prompt content = disable-eval-for-function-supplied-prompt-content; evaluate only statically configured templates
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
Deployments using ash_ai versions from 0.1.0 before 1.0.0 are exposed when a reachable prompt action incorporates request-controlled data into prompt text supplied through the documented function form. An attacker needs only network access to such a prompt action; authentication is not required.
Does exploitation require a model provider request or response?
No. The injected EEx content is evaluated on the server before any model request is made, so exploitation does not depend on a model provider being contacted.
What configuration change can reduce exposure before upgrading?
Avoid allowing request data to become part of function-supplied prompt content. Use only statically configured templates where possible, because the fix retains EEx evaluation only for static templates.
How can I determine whether an application is affected?
Check whether ash_ai is installed at a version from 0.1.0 through any version before 1.0.0, then review prompt actions for the documented "fn input, context -> ... end" form. Those actions are vulnerable when their resulting prompt text incorporates data supplied by requests.