CVE-2026-67579: ash framework from 1.17.0 (inclusive), before 3.31.3 (exclusive); +1 more affected products

Affected technology

ash framework · from 1.17.0 (inclusive), before 3.31.3 (exclusive)
ash-hq

ash · 1.17.0 to before 3.31.3
ash-project

ash · f8fadc67e67c955bb68b3a8d642be13e2b7e8ca9 to before 91874dd5435bc0ffebd8a254acfa573b39b74520
ash-project

Component: 'Elixir.Ash.Page.Keyset'
Function: 'Elixir.Ash.Page.Keyset':decode_values/2, 'Elixir.Ash.Page.Keyset':do_filters/4, call
File: lib/ash/page/keyset.ex

Attack conditions (Source advisory, CVSS 4.0): Local · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker can inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Source advisory’s CVSS 4.0 assessment (base score 7.5/10) rates confidentiality, integrity and availability impact as high.