CVE-2026-82732: Declared argument constraints not enforced on AshTypescript typed controller routes
Improper Input Validation vulnerability in ash-project ashtypescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes.
AshTypescript.TypedController.RequestHandler in lib/ashtypescript/typedcontroller/requesthandler.ex calls Ash.Type.castinput/3 and treats an {:ok, cast} result as fully validated. In Ash these are separate steps: castinput/3 only coerces the term, while every constraint declared on the argument is applied by Ash.Type.applyconstraints/3, which this path never calls. Constraints such as oneof, maxlength, min and max, and match are therefore inert, so a value outside a declared allowlist is accepted and passed to the route handler. Codegen renders the same constraints into the generated TypeScript types, so an allowlist appears enforced to a TypeScript caller while any other HTTP client ignores it. Empty-string to nil normalization also lives in applyconstraints, so the allownil?: false check accepts "" for a required argument.
Where a constraint gates a role, a status, or a sort direction, this becomes a privilege or state-machine bypass.
This issue affects ashtypescript: from 0.15.0 before 0.18.0.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using ash_typescript typed-controller routes are exposed when route arguments rely on Ash constraints such as one_of, max_length, min, max, or match. The issue also affects required arguments because an empty string can be accepted where allow_nil?: false is expected to reject missing input.
What does an attacker need to exploit this?
An attacker needs to send an HTTP request to an affected typed-controller route with argument values that violate the route's declared constraints. They do not need to use the generated TypeScript client, so its rendered types do not prevent a non-TypeScript HTTP client from submitting invalid values.
When is the impact most significant?
Impact is highest when a constrained argument controls a role, status, or sort direction. In those cases, accepting values outside the declared constraint can produce a privilege bypass or state-machine bypass.