Packages

ash_lua

0.2.2

0.2.2 0.2.1 0.2.0 0.1.6 0.1.5 0.1.4 0.1.3 0.1.2 0.1.1 0.1.0

An Ash extension for embedding Lua scripts with a consistent actor, tenant, and context.

HexDocs Report package

Current section

2 Advisories

Jump to

Readme 10 Versions 5 Dependencies 0 Dependants 2 Advisories Files Activity

EEF-CVE-2026-78216 CVE-2026-78216 GHSA-5whv-8rcp-x33j

AshLua eval read operations can read field-policy-protected fields via aggregates

September 08, 2026

CVSS

6.0 / 10.0 Medium

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 0.1.0 and < 0.2.2

References

EEF-CVE-2026-82586 CVE-2026-82586 GHSA-37jv-wc37-fhcw

AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

September 07, 2026

CVSS

8.2 / 10.0 High

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 0.1.0 and < 0.2.1

References

Checksum

Dependency Config

mix.exs

rebar.config

Gleam

erlang.mk

Package Details

Downloads Last 30 days, all versions

this version

573

yesterday

last 7 days

557

all time

12 797

Last Updated

Sep 08, 2026

License

MIT

Build Tools

mix

Publisher

ash-project

Owners

ash-project

Operator	Description	Example
name:	Match package name. Supports * wildcards and repo/package form	name:phx* or name:hexpm/phoenix
description:	Full-text search of package descriptions	description:auth
depends:	Packages depending on a given package. Supports repo:package form	depends:ecto or depends:hexpm:ecto
build_tool:	Filter by build tool	build_tool:mix
updated_after:	Packages updated after an ISO8601 datetime	updated_after:2025-01-01T00:00:00Z
extra:	Match custom metadata (key,value). Nested keys are separated by commas	extra:license,MIT

ash_lua

Checksum

Dependency Config

Package Details

Links

Owners

Search filters