CVE-2026-82681: Query-parameter injection in AshAdmin row-action links via unencoded string primary keys
Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links.
The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the primary key (and table, domain, and resource names) into the query string without URL-encoding. Ash resources routinely use user-settable string primary keys (slugs, emails). Because Plug.Conn.Query resolves duplicate parameters last-wins and primarykey is interpolated last, a stored key such as foo&actiontype=destroy injects parameters that override the link, so an admin clicking edit is sent to a destroy form or an arbitrary resource; a # truncates the query into a fragment. The fix builds every link with URI.encodequery/1, encoding all interpolated values.
This issue affects ashadmin: from 0.3.0-rc.0 before 1.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project/ash_adminto a version that resolves this vulnerability.Fixed in 1.3.1 - Compensating control
If you cannot upgrade ash_admin immediately, mitigate query-parameter injection in AshAdmin row-action links by ensuring all interpolated values (string primary key/slug/email, plus table/domain/resource names used in query strings) are URL-encoded with URI.encode_query/1 when building Table/DataTable/Show row-action URLs.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
AshAdmin deployments from 0.3.0-rc.0 before 1.3.1 are exposed where row-action links are rendered for records whose string primary keys can be controlled by an attacker. Common examples include user-settable slugs or email-based primary keys viewed by an administrator.
What does an attacker need to exploit it?
An attacker needs to cause a record to have a crafted string primary key, such as one containing an ampersand and injected query parameters. They then need an administrator to use a row-action link for that record.
What is the impact of the injected parameters?
Because duplicate query parameters are resolved last-wins and the primary key is appended last, a crafted key can override row-action parameters. An edit link can be redirected to a destroy form or an arbitrary resource, and a hash character can truncate the query into a fragment.
What should be done if patching cannot happen immediately?
Limit or prevent untrusted users from setting string primary keys on resources displayed in AshAdmin, and review existing string primary keys for query-string characters such as &, =, and #. Administrators should avoid using row-action links for suspicious records until the deployment is updated.
How can I tell whether the installed version is affected?
Versions from 0.3.0-rc.0 up to, but not including, 1.3.1 are affected. Version 1.3.1 fixes the issue by URL-encoding interpolated values when building links.