During RPC error handling, the error builder renders a pipeline error term that falls through to a generic clause and uses inspect/1. This places the raw Elixir term inside the error response, which exposes internal data to an unauthenticated client. The vulnerability falls under CWE‑209 and therefore discloses confidential information. The CVSS v3.1 score of 6.3 indicates a moderate impact that can compromise confidentiality but does not lead to code execution or denial of service.

The affected product is ash-project’s ash_typescript. Version support ranges from 0.1.0 up to, but not including, 0.19.1. Any installation of ash_typescript in that range is vulnerable; newer releases contain the fix.

The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation reports to date. However, an attacker can trigger the error by sending a malformed action argument or by requesting a field selection that triggers an unhandled cast error, so the exploit is straightforward once the target is connected. The risk is moderate: the attack requires an unsecured RPC interface and an ability to send crafted requests, but it does not require privileged access or credentials.