Current section

5 Advisories

Jump to
EEF-CVE-2026-77454 CVE-2026-77454 GHSA-8v9m-8pxv-738c

exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql

August 30, 2026
CVSS
?
5.9 / 10.0 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 0.4.1 and < 0.7.1
EEF-CVE-2026-81316 CVE-2026-81316 GHSA-v7pf-wjxc-7j5m

Same-named aggregates with differing filters are conflated in AshSql

August 30, 2026
CVSS
?
2.1 / 10.0 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 0.1.0 and < 0.7.1
EEF-CVE-2026-81318 CVE-2026-81318 GHSA-ww8j-58rc-f8h3

Distinct-query aggregate drops the tenant schema prefix, leaking across tenants in AshSql

August 30, 2026
CVSS
?
2.1 / 10.0 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 0.1.0 and < 0.7.1
EEF-CVE-2026-78691 CVE-2026-78691 GHSA-5jgp-7mhc-6qqh

Unescaped backslash allows LIKE wildcard injection in AshSql string search

August 30, 2026
CVSS
?
2.1 / 10.0 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 0.1.1-rc.10 and < 0.7.1
EEF-CVE-2026-80227 CVE-2026-80227 GHSA-76wx-w7ww-5xfq

SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql

August 30, 2026
CVSS
?
2.1 / 10.0 Low
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Versions

>= 0.1.0 and < 0.7.1

Checksum

Dependency Config

mix.exs

rebar.config

Gleam

erlang.mk

Package Details

Downloads Last 30 days, all versions
0 1K 2K 3K 4K

this version

0

yesterday

2 101

last 7 days

25 931

all time

1 089 964

Last Updated

Aug 30, 2026

License

MIT

Build Tools

mix

Publisher

ash-project ash-project