CVE-2026-82731: Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ashtypescript allows an attacker who controls a path-parameter value to redirect a generated client's request, and the credentials attached to it, to an unintended route or an external origin.
The URL builders in lib/ashtypescript/typedcontroller/codegen/routerenderer.ex replace each :param placeholder with a bare template interpolation and never call encodeURIComponent, so the value reaches executeTypedControllerRequest raw. A value containing ../ is normalised away by the fetch URL resolver and reaches a different route, while ? or # truncates the path and can smuggle or override query parameters. For a route whose path begins with a parameter, a value such as /evil.example.com/x yields the protocol-relative URL //evil.example.com/x, sending the request and the credentials from TypedControllerConfig to an attacker-controlled host. Nothing constrains the value at runtime: getpathparamtype/2 emits only a TypeScript type, which is erased.
The query-string path is unaffected, since URLSearchParams.set encodes its own values.
This issue affects ashtypescript: from 0.15.0 before 0.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ash-project ash_typescriptto a version that resolves this vulnerability.Fixed in 0.18.0 - Configuration
Ensure path parameters used in generated routes are runtime-constrained/encoded so values like '/evil.example.com/x' and payloads containing '../', '?' or '#' cannot be injected into the rendered URL without encodeURIComponent (or equivalent) when constructing request URLs.
ash_typescript generated TypeScript client routes path parameter value encoding/constraint = encode/validate path parameter values to prevent protocol-relative URLs and path/query smuggling
Event History
Frequently Asked Questions
Which generated-client calls are exposed to external-origin request redirection?
Calls for routes whose path begins with a path parameter can be redirected to an external origin when an attacker supplies a value such as /evil.example.com/x. The generated request can send credentials configured in TypedControllerConfig to that attacker-controlled host.
What attacker control is required to exploit this issue?
The attacker must control a path-parameter value used by the generated TypeScript client. Path parameters are interpolated without URL encoding, and the generated TypeScript type does not impose runtime validation.
Can this affect routes even when they do not start with a path parameter?
Yes. A path-parameter value containing ../ can cause URL resolution to reach a different route, while ? or # can truncate the path and smuggle or override query parameters. External-origin redirection specifically requires a route whose path begins with a parameter.
Are query-string parameters affected by the same encoding flaw?
No. The query-string path uses URLSearchParams.set, which encodes its values.
Which ash_typescript versions are affected?
The issue affects ash_typescript versions from 0.15.0 before 0.18.0.