EEF-CVE-2026-81852
- Source
- https://cna.erlef.org/osv/EEF-CVE-2026-81852.html
- Import Source
- https://cna.erlef.org/osv/EEF-CVE-2026-81852.json
- JSON Data
- https://api.osv.dev/v1/vulns/EEF-CVE-2026-81852
- Aliases
-
- CVE-2026-81852
- GHSA-whfj-rrrp-j597
- Published
- 2026-08-31T02:29:14Z
- Modified
- 2026-09-08T03:45:07Z
- Severity
-
- 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass
- Details
-
Summary
Use of Insufficiently Random Values vulnerability in ash-project ash_admin ships a hardcoded, publicly known CSP nonce, defeating nonce-based Content-Security-Policy protection.
When mounted without
:csp_nonce_assign_key,AshAdmin.Router.ash_admin/2defaulted the img, style, and script nonces to the literal constantash_admin-Ed55GFnX, whichAshAdmin.Layoutswrote verbatim into thenonceattribute of its inline<style>and<script>tags on every response. The value is a compile-time constant published in the repository and is never rotated per request. If an application's CSPscript-srcallow-lists that documented default, any HTML-injection sink on an admin page can reuse the known nonce to run inline scripts the policy was meant to block. The fix generates a fresh random nonce per request.This issue affects ash_admin: from 0.10.8 before 1.3.1.
Configurations
The application mounts AshAdmin without
:csp_nonce_assign_keyand enforces a nonce-based CSP whosescript-srcallow-lists the defaultash_admin-Ed55GFnXvalue, and has a separate HTML-injection sink on an admin page. - Database specific
{ "capec_ids": [ "CAPEC-63" ], "cpe_ids": [ "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*" ], "cwe_ids": [ "CWE-330" ] }- References
- Credits
-
-
- Peter Ullrich - FINDER
-
- Peter Ullrich - REPORTER
-
- Zach Daniel / Ash Project - REMEDIATION_DEVELOPER
-
- Jonatan Männchen / EEF - COORDINATOR
-
Affected packages
Hex / ash_admin
Package
- Name
- ash_admin
- Purl
- pkg:hex/ash_admin