EEF-CVE-2026-77956
- Source
- https://cna.erlef.org/osv/EEF-CVE-2026-77956.html
- Import Source
- https://cna.erlef.org/osv/EEF-CVE-2026-77956.json
- JSON Data
- https://api.osv.dev/v1/vulns/EEF-CVE-2026-77956
- Aliases
-
- CVE-2026-77956
- GHSA-2g59-hg7m-qc83
- Published
- 2026-08-31T00:56:26.440Z
- Modified
- 2026-08-31T01:10:34.735145205Z
- Severity
-
- 10.0 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
- Summary
- EEx template evaluation of prompt content in AshAi enables remote code execution
- Details
-
Summary
Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code.
AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -> ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as <%= System.cmd(...) %> therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.
This issue affects ash_ai: from 0.1.0 before 1.0.0.
- Database specific
{ "cpe_ids": [ "cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*" ], "capec_ids": [ "CAPEC-242" ], "cwe_ids": [ "CWE-94" ] }- References
- Credits
-
-
- Peter Ullrich - FINDER
-
- Peter Ullrich - REPORTER
-
- Zach Daniel / Ash Project - REMEDIATION_DEVELOPER
-
- Jonatan Männchen / EEF - COORDINATOR
-
Affected packages
Hex / ash_ai
Package
- Name
- ash_ai
- Purl
- pkg:hex/ash_ai