CVE-2025-48042: ash 0.1.1 to before 3.5.39

Affected technology

ash · 0.1.1 to before 3.5.39
ash-project

ash · 4c41344126b0aba09ec3085517000f8aefec299e to before 5d1b6a5d00771fd468a509778637527b5218be9a
ash-project

Component: 'Elixir.Ash.Actions.Create.Bulk', 'Elixir.Ash.Actions.Update.Bulk', 'Elixir.Ash.Actions.Destroy.Bulk'
Function: 'Elixir.Ash.Actions.Create.Bulk':run/5, 'Elixir.Ash.Actions.Update.Bulk':run/6, 'Elixir.Ash.Actions.Destroy.Bulk':run/6
File: lib/ash/actions/create/bulk.ex, lib/ash/actions/update/bulk.ex, lib/ash/actions/destroy/bulk.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality impact as none; integrity impact as high; availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.