CVE-2026-105283: ash_typescript 0.1.0 to before 0.19.1

Affected technology

ash_typescript · 0.1.0 to before 0.19.1
ash-project

ash_typescript · 8e204ce34e24a158cf22a2dac4d53c44716c9e30 to before 4b3c65203ee78dc992d6d2e6559625c5460a01cd
ash-project

Component: 'Elixir.AshTypescript.Rpc.ErrorBuilder', 'Elixir.AshTypescript.Rpc.InputFormatter', 'Elixir.AshTypescript.Rpc'
Function: 'Elixir.AshTypescript.Rpc.ErrorBuilder':build_error_response/1, 'Elixir.AshTypescript.Rpc.ErrorBuilder':format_field_type/1, 'Elixir.AshTypescript.Rpc.InputFormatter':cast_map_to_struct/2, 'Elixir.AshTypescript.Rpc':run_action/3, 'Elixir.AshTypescript.Rpc':validate_action/3
File: lib/ash_typescript/rpc/error_builder.ex, lib/ash_typescript/rpc/input_formatter.ex, lib/ash_typescript/rpc.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for. Source advisory’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality impact as low; integrity and availability impact as none.