Stored Cross‑Site Scripting occurs when the relationship typeahead component highlights a matched search term by wrapping it in <b> tags and rendering the entire string with Phoenix.HTML.raw/1. The highlighted value comes from the destination record’s label_field, which is user‑supplied content. Because raw/1 disables output escaping for the whole string, an attacker can store malicious markup such as <img src=x onerror=…> in the label. When an administrator opens the relationship dropdown and the record appears, the script executes in the admin’s browser session, effectively giving the attacker the full administrative compromise of AshAdmin.

The vulnerability exists in ash-project’s AshAdmin component. It affects all releases from version 0.13.0 up to and including 1.3.0. Versions 1.3.1 and later contain an HTML‑escape fix that prevents the XSS vector.

The CVSS score is 8.4, indicating a high severity risk. EPSS data is not available, but the lack of a KEV listing does not diminish the likelihood that an attacker could exploit this flaw. The attack is likely achievable through normal use of the typeahead feature: a low‑privilege user writes a malicious label, and when a privileged user engages that feature the payload runs. The result is a full‑privilege break into the application, which makes the risk of exploitation significant.