The application exposes an AshTypescript typed controller over HTTP with at least one route argument carrying a constraints declaration that gates application behaviour.
Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes.
\nAshTypescript.TypedController.RequestHandler in lib/ash_typescript/typed_controller/request_handler.ex calls Ash.Type.cast_input/3 and treats an {:ok, cast} result as fully validated. In Ash these are separate steps: cast_input/3 only coerces the term, while every constraint declared on the argument is applied by Ash.Type.apply_constraints/3, which this path never calls. Constraints such as one_of, max_length, min and max, and match are therefore inert, so a value outside a declared allowlist is accepted and passed to the route handler. Codegen renders the same constraints into the generated TypeScript types, so an allowlist appears enforced to a TypeScript caller while any other HTTP client ignores it. Empty-string to nil normalization also lives in apply_constraints, so the allow_nil?: false check accepts \"\" for a required argument.
Where a constraint gates a role, a status, or a sort direction, this becomes a privilege or state-machine bypass.
\nThis issue affects ash_typescript: from 0.15.0 before 0.18.0.
" }, { "base64": false, "type": "text/markdown", "value": "Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes.\n\n`AshTypescript.TypedController.RequestHandler` in `lib/ash_typescript/typed_controller/request_handler.ex` calls `Ash.Type.cast_input/3` and treats an `{:ok, cast}` result as fully validated. In Ash these are separate steps: `cast_input/3` only coerces the term, while every constraint declared on the argument is applied by `Ash.Type.apply_constraints/3`, which this path never calls. Constraints such as `one_of`, `max_length`, `min` and `max`, and `match` are therefore inert, so a value outside a declared allowlist is accepted and passed to the route handler. Codegen renders the same constraints into the generated TypeScript types, so an allowlist appears enforced to a TypeScript caller while any other HTTP client ignores it. Empty-string to `nil` normalization also lives in `apply_constraints`, so the `allow_nil?: false` check accepts `\"\"` for a required argument.\n\nWhere a constraint gates a role, a status, or a sort direction, this becomes a privilege or state-machine bypass.\n\nThis issue affects ash_typescript: from 0.15.0 before 0.18.0." } ], "value": "Improper Input Validation vulnerability in ash-project ash_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes.\n\nAshTypescript.TypedController.RequestHandler in lib/ash_typescript/typed_controller/request_handler.ex calls Ash.Type.cast_input/3 and treats an {:ok, cast} result as fully validated. In Ash these are separate steps: cast_input/3 only coerces the term, while every constraint declared on the argument is applied by Ash.Type.apply_constraints/3, which this path never calls. Constraints such as one_of, max_length, min and max, and match are therefore inert, so a value outside a declared allowlist is accepted and passed to the route handler. Codegen renders the same constraints into the generated TypeScript types, so an allowlist appears enforced to a TypeScript caller while any other HTTP client ignores it. Empty-string to nil normalization also lives in apply_constraints, so the allow_nil?: false check accepts \"\" for a required argument.\n\nWhere a constraint gates a role, a status, or a sort direction, this becomes a privilege or state-machine bypass.\n\nThis issue affects ash_typescript: from 0.15.0 before 0.18.0." } ], "impacts": [ { "capecId": "CAPEC-153", "descriptions": [ { "lang": "en", "value": "CAPEC-153 Input Data Manipulation" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-01T02:09:15.070Z" }, "references": [ { "tags": [ "related", "vendor-advisory" ], "url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-f7fq-hwq6-jhvv" }, { "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-82732.html" }, { "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82732" }, { "tags": [ "patch" ], "url": "https://github.com/ash-project/ash_typescript/commit/21ab6f1229a4dccdb56bc37ed437d9672a0c4a4e" } ], "source": { "discovery": "EXTERNAL" }, "title": "Declared argument constraints not enforced on AshTypescript typed controller routes" } } }