Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ashai allows a remote, unauthenticated client to execute arbitrary Elixir code.
AshAi.Actions.Prompt evaluates prompt content through EEx.evalstring/2. The documented prompt: fn input, context -> ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as <%= System.cmd(...) %> therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.
This issue affects ashai: from 0.1.0 before 1.0.0.
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses internal error text to chat users.
In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content. That content is appended to the conversation, emitted as a {:toolresult, ...} stream event, and sent back to the model, which typically relays it to the user. No filtering happened first, so anything raised inside a tool callback or lifecycle hook (database constraint messages, adapter errors, query fragments, policy or validation internals) was echoed as-is. A chat user who can steer tool arguments into a raising code path receives the raw internal text. The fix routes raised tool errors through the same safe formatter used for other tool errors.
This issue affects ashai: from 0.6.0 before 1.0.0.
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses provider request state and credentials in a user-facing validation error.
In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message inspected the raw error term (An error occurred while generating embeddings: #{inspect(error)}). A plain-string adderror produces an Ash.Error.Changes.InvalidChanges in the :invalid class, which AshJsonApi and AshGraphql render back to the caller. The embedding client's error term is not sanitized, so it can carry the request URL, the provider response body, and, for HTTP clients that keep the request in the error struct, the outbound Authorization header with the provider API key. Failures are attacker-reachable via oversized or malformed vectorized content. The fix logs the raw error and returns a generic message.
This issue affects ashai: from 0.1.0 before 1.0.0.
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table.
In AshAi.Tool.Execution, identityfilter/3 built the update/destroy filter directly from the raw tool arguments as [{key, Map.get(arguments, tostring(key))}] and passed it to Ash.Query.dofilter/2. A map value is parsed as a predicate expression rather than a literal, so a caller can send {"publicref": {"noteq": "<own-ref>"}} and, combined with Ash.Query.limit(1) and Ash.bulkupdate!/Ash.bulkdestroy!, retarget the write at a record it never identified; an omitted key yields an IS NULL filter that matches an arbitrary row. The fix casts each identity value to the field type, rejecting non-scalar inputs.
This issue affects ashai: from 0.6.0 before 1.0.0.