{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-77850", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-08-31T00:45:02.443Z", "datePublished": "2026-08-31T02:23:54.129Z", "dateUpdated": "2026-08-31T02:23:54.129Z" }, "containers": { "cna": { "affected": [ { "collectionURL": "https://repo.hex.pm", "cpes": [ "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "modules": [ "'Elixir.AshAdmin.Components.Resource.RelationshipField'", "'Elixir.AshAdmin.Components.Resource.ManagedRelationshipSelectField'" ], "packageName": "ash_admin", "packageURL": "pkg:hex/ash_admin", "product": "ash_admin", "programFiles": [ "lib/ash_admin/components/resource/relationship_field.ex", "lib/ash_admin/components/resource/managed_relationship_select_field.ex" ], "repo": "https://github.com/ash-project/ash_admin", "vendor": "ash-project", "versions": [ { "lessThan": "1.3.1", "status": "affected", "version": "0.13.0", "versionType": "semver" } ] }, { "collectionURL": "https://github.com", "cpes": [ "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "modules": [ "'Elixir.AshAdmin.Components.Resource.RelationshipField'", "'Elixir.AshAdmin.Components.Resource.ManagedRelationshipSelectField'" ], "packageName": "ash-project/ash_admin", "packageURL": "pkg:github/ash-project/ash_admin", "product": "ash_admin", "programFiles": [ "lib/ash_admin/components/resource/relationship_field.ex", "lib/ash_admin/components/resource/managed_relationship_select_field.ex" ], "repo": "https://github.com/ash-project/ash_admin", "vendor": "ash-project", "versions": [ { "lessThan": "07289191ccdac27dd70ab7c6413ed057bc7fdade", "status": "affected", "version": "eb940f4d7d857ca49368ae847f586d01c6f5ad35", "versionType": "git" } ] } ], "cpeApplicability": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.3.1", "versionStartIncluding": "0.13.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ], "operator": "AND" } ], "credits": [ { "lang": "en", "type": "finder", "value": "Peter Ullrich" }, { "lang": "en", "type": "reporter", "value": "Peter Ullrich" }, { "lang": "en", "type": "remediation developer", "value": "Zach Daniel / Ash Project" }, { "lang": "en", "type": "coordinator", "value": "Jonatan Männchen / EEF" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser.

\n

The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in <b> tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record's label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as <img src=x onerror=...> runs as JavaScript in the admin's session as soon as a matching record appears in the dropdown, giving the attacker the admin's privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.

\n

This issue affects ash_admin: from 0.13.0 before 1.3.1.

" }, { "base64": false, "type": "text/markdown", "value": "Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser.\n\nThe relationship typeahead components `AshAdmin.Components.Resource.RelationshipField` and `AshAdmin.Components.Resource.ManagedRelationshipSelectField` highlight the matched search term by wrapping it in `` tags and rendering the whole string with `Phoenix.HTML.raw/1`. The highlighted value is the destination record's `label_field`, ordinary database content that is often written by lower-privileged users. Because `raw/1` disables output escaping for the entire string, a stored label such as `` runs as JavaScript in the admin's session as soon as a matching record appears in the dropdown, giving the attacker the admin's privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.\n\nThis issue affects ash_admin: from 0.13.0 before 1.3.1." } ], "value": "Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser.\n\nThe relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record's label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as runs as JavaScript in the admin's session as soon as a matching record appears in the dropdown, giving the attacker the admin's privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.\n\nThis issue affects ash_admin: from 0.13.0 before 1.3.1." } ], "impacts": [ { "capecId": "CAPEC-592", "descriptions": [ { "lang": "en", "value": "CAPEC-592 Stored XSS" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.4, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-08-31T02:23:54.129Z" }, "references": [ { "tags": [ "vendor-advisory", "related" ], "url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-m23x-576h-73w8" }, { "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-77850.html" }, { "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-77850" }, { "tags": [ "patch" ], "url": "https://github.com/ash-project/ash_admin/commit/07289191ccdac27dd70ab7c6413ed057bc7fdade" } ], "source": { "discovery": "EXTERNAL" }, "title": "Stored XSS in AshAdmin relationship typeahead via unescaped label_field content" } } }