Description
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match.

apply_error_handler/3 in lib/ash_typescript/rpc/errors.ex is the only hook an application has for redacting or suppressing errors before they reach the client, with a nil return dropping the error entirely. Its rescue clause logs a warning and then returns the original, pre-handler error map. Error handlers are conventionally written as pattern-matching functions over expected error shapes, so an unmatched shape raises FunctionClauseError and the raw transformed error, including any secrets carried in vars, is emitted instead. An intent to suppress an error becomes an intent to publish it. The rescue catches exceptions only, so a handler that throws or exits still propagates.

This issue affects ash_typescript: from 0.8.0 before 0.18.0.
Published: 2026-09-01
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unrestricted disclosure of internal error information
Action: Patch Immediately
AI Analysis

Impact

Ash‑typescript’s RPC error handling path allows an attacker to trigger an error shape mismatch that bypasses the error redaction logic. When the configured error handler fails to match a given error shape, a rescue clause logs a warning and returns the original error map, which may contain sensitive variables. The mismatch triggers a FunctionClauseError that propagates the raw, unredacted error to the client, thereby exposing system secrets. This flaw is classified as a CWE‑209 information‑exposure vulnerability.

Affected Systems

The bug is present in all ash‑project ash_typescript releases from 0.8.0 up to, but not including, 0.18.0. Both the library code and its Erlang‑based RPC machinery are affected. The error handling improvement was introduced in version 0.18.0.

Risk and Exploitability

With a CVSS score of 6.3 the vulnerability is medium severity, and no EPSS score is available. The issue is not listed in the CISA KEV catalog. Because the RPC interface is publicly reachable and only requires no special authentication, an unauthenticated attacker can provoke the error condition. The resulting disclosure could leak credentials or other sensitive data, potentially enabling further intrusion. Prompt remediation is recommended.

Generated by OpenCVE AI on September 1, 2026 at 03:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ash-typescript to 0.18.0 or later, where the error handler correctly sanitizes error maps.
  • If an upgrade is not immediately feasible, replace or extend the apply_error_handler/3 function with logic that validates error shapes and explicitly redacts or discards any fields containing secrets, adopting mitigation patterns for CWE‑209.
  • Disable detailed error responses in production by configuring the RPC server to return generic error messages and ensure log sinks discard sensitive data, thereby preventing accidental information exposure.

Generated by OpenCVE AI on September 1, 2026 at 03:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 01 Sep 2026 02:45:00 +0000

Type Values Removed Values Added
Description Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. apply_error_handler/3 in lib/ash_typescript/rpc/errors.ex is the only hook an application has for redacting or suppressing errors before they reach the client, with a nil return dropping the error entirely. Its rescue clause logs a warning and then returns the original, pre-handler error map. Error handlers are conventionally written as pattern-matching functions over expected error shapes, so an unmatched shape raises FunctionClauseError and the raw transformed error, including any secrets carried in vars, is emitted instead. An intent to suppress an error becomes an intent to publish it. The rescue catches exceptions only, so a handler that throws or exits still propagates. This issue affects ash_typescript: from 0.8.0 before 0.18.0.
Title RPC error handler fails open in AshTypescript, disclosing unredacted errors
First Time appeared Ash-project
Ash-project ash Typescript
Weaknesses CWE-209
CPEs cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*
Vendors & Products Ash-project
Ash-project ash Typescript
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Ash-project Ash Typescript
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-01T14:53:26.458Z

Reserved: 2026-08-30T17:30:01.402Z

Link: CVE-2026-77950

cve-icon Vulnrichment

Updated: 2026-09-01T14:50:36.257Z

cve-icon NVD

Status : Deferred

Published: 2026-09-01T03:16:51.660

Modified: 2026-09-01T21:15:00.147

Link: CVE-2026-77950

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T14:16:01Z

Weaknesses
  • CWE-209

    Generation of Error Message Containing Sensitive Information