Packages

ash_admin

1.3.1
1.3.1 1.3.0 1.2.0 1.1.0 1.0.0-rc.0 0.14.0 0.13.26 0.13.25 0.13.24 0.13.23 0.13.22 0.13.21 0.13.20 0.13.19 0.13.18 0.13.17 0.13.16 0.13.15 0.13.14 0.13.13 0.13.12 0.13.11 0.13.10 0.13.9 0.13.8 0.13.7 0.13.6 0.13.5 0.13.4 0.13.3 0.13.2 0.13.1 0.13.0 0.12.6 0.12.5 0.12.4 0.12.3 0.12.2 0.12.1 0.12.0 0.11.11 0.11.10 0.11.9 0.11.8 0.11.7 0.11.6 0.11.5 0.11.4 0.11.3 0.11.2 0.11.1 0.11.0 0.10.12 0.10.11 0.10.10 retired 0.10.10-rc.1 0.10.10-rc.0 0.10.9 0.10.8 0.10.7 0.10.6 0.10.5 0.10.4 0.10.3 0.10.2 0.10.1 0.10.0 0.9.8 0.9.7 0.9.6 0.9.5 0.9.4 0.9.3 0.9.2 0.9.1 0.9.0 0.8.1 0.8.0 0.7.1 0.7.0 0.6.2 0.6.1 0.6.0-rc.2 0.6.0-rc.1 0.6.0-rc.0 0.5.2 0.5.1-rc.0 0.5.0 0.4.5-rc.0 0.4.4 0.4.2 0.4.0 0.3.0-rc.0 0.2.22 0.2.21 0.2.20 0.2.19 0.2.18 0.2.17 0.2.16-rc.1 0.2.16-rc.0 0.2.15 0.2.14 0.2.13 0.2.12 0.2.11 0.2.10 0.2.9 0.2.8 0.2.7 0.2.6 0.2.5 0.2.4 0.2.3 0.2.1 0.1.6 0.1.5 0.1.3 0.1.2 0.1.0

A super-admin UI for Ash Framework, built with Phoenix LiveView.

HexDocs Report package

Current section

7 Advisories

Jump to
Readme
120 Versions
9 Dependencies
0 Dependants
7 Advisories
Files
Activity
EEF-CVE-2026-82673 CVE-2026-82673 GHSA-483p-rgcq-p5j9

Path traversal in AshAdmin file uploads via unsanitized client filename

August 31, 2026
CVSS
?
8.3 / 10.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Affected Versions

>= 0.13.7 and < 1.3.1
EEF-CVE-2026-81853 CVE-2026-81853 GHSA-jxr8-hpv2-qp38

AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle

August 31, 2026
CVSS
?
2.3 / 10.0 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 0.1.0 and < 1.3.1
EEF-CVE-2026-81852 CVE-2026-81852 GHSA-whfj-rrrp-j597

AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

August 31, 2026
CVSS
?
2.1 / 10.0 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 0.10.8 and < 1.3.1
EEF-CVE-2026-82681 CVE-2026-82681 GHSA-j89q-xjrh-c26p

Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

August 31, 2026
CVSS
?
2.0 / 10.0 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 0.3.0-rc.0 and < 1.3.1
EEF-CVE-2026-77850 CVE-2026-77850 GHSA-m23x-576h-73w8

Stored XSS in AshAdmin relationship typeahead via unescaped label_field content

August 31, 2026
CVSS
?
8.4 / 10.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 0.13.0 and < 1.3.1
EEF-CVE-2026-82722 CVE-2026-82722 GHSA-wcr6-9rrw-5jhv

AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)

August 31, 2026
CVSS
?
8.3 / 10.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Affected Versions

>= 0.1.0 and < 1.3.1
EEF-CVE-2026-75757 CVE-2026-75757 GHSA-3259-55fp-w94j

AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

August 31, 2026
CVSS
?
8.3 / 10.0 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 0.9.1 and < 1.3.1

Checksum

Dependency Config

mix.exs

rebar.config

Gleam

erlang.mk

Package Details

Downloads Last 30 days, all versions
0 500 1000 1500 2000

this version

0

yesterday

623

last 7 days

8 592

all time

478 383

Last Updated

Aug 31, 2026

License

MIT

Build Tools

mix

Publisher

ash-project ash-project

Links

Owners