Origin Validation Error vulnerability in ash-project ashai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor.

In AshAi.Mcp.Server, with the default allowedorigins: nil, originallowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https. Both values are attacker-controlled: conn.host comes from the Host header and the scheme is read from the raw x-forwarded-proto header with no trusted-proxy check. Under DNS rebinding the browser sends the attacker's origin and a matching host, and page JavaScript may set X-Forwarded-Proto: https, so the check passes with no TLS or proxy involved. The fix trusts only localhost origins by default; other origins require an explicit allowedorigins allowlist.

This issue affects ashai: from 0.8.0 before 1.0.0.

Loop with Unreachable Exit Condition (Infinite Loop) vulnerability in ash-project ashai allows an attacker who can influence a model's output to hang the tool loop and drive unbounded, repeated model requests.

AshAi.ToolLoop classifies a model response of :toolcalls, then filters the calls through normalizetoolcalls/2 and unprocessedtoolcalls/2. Both can empty the list: a call missing a valid name, or one reusing a toolcallid that already has a result in history, is dropped. With an empty list the loop appended nothing and recursed with a byte-identical message list, so the conversation never advanced and the same request was re-sent every iteration. Under the supported maxiterations: :infinity this never terminated; otherwise it exhausted the full budget. Prompt-injected content can make the model re-emit a spent toolcallid. The fix treats an empty post-filter list as terminal.

This issue affects ashai: from 0.6.0 before 1.0.0.