Description
Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code.

AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -> ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as <%= System.cmd(...) %> therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.

This issue affects ash_ai: from 0.1.0 before 1.0.0.
Published: 2026-08-31
Score: 8.9 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a code injection flaw arising from the use of EEx.eval_string/2 to render prompt content supplied by the caller. Prompt actions are defined as functions that accept input and context, allowing the caller to embed arbitrary expressions inside the prompt. Because the library compiles any prompt text containing EEx delimiters, a remote client can send a prompt that includes Elixir calls such as System.cmd, which are executed server‑side before the model request is sent, granting unauthenticated remote code execution. This flaw matches CWE‑94: Improper Control of Generation of Code.

Affected Systems

The affected product is Ash Ai, a library by the Ash Project. Versions from 0.1.0 up to but not including 1.0.0 are affected. No specific sub‑versions are listed, so all releases in that range are vulnerable. System administrators should verify which version of Ash Ai is in use and ensure only versions 1.0.0 or later run in production.

Risk and Exploitability

The CVSS base score of 10 indicates a full‑blown critical vulnerability. The EPSS score is not available, but the lack of exploit data does not reduce the likelihood, given the client‑side exploitation path requires only an HTTP request containing crafted prompt text. The vulnerability is not listed in the CISA KEV catalog, but the impact and severity recommend rapid remediation. The attack vector is remote, unauthenticated, and requires no special privileges; an attacker can trigger the flaw by simply sending a prompt action request to an exposed Ash Ai instance.

Generated by OpenCVE AI on August 31, 2026 at 02:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a fixed release (Ash Ai 1.0.0 or later) that stops evaluating function‑supplied prompt content as EEx.
  • If an immediate upgrade is not possible, modify the configuration so that only statically defined prompt templates are evaluated, or temporarily disable EEx.eval_string usage for user‑supplied prompts.
  • Apply network or application‑level access controls to restrict who can invoke prompt actions until a patched version is in place.

Generated by OpenCVE AI on August 31, 2026 at 02:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

 cvssV4_0

{'score': 8.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Mon, 31 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
Description Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -> ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as <%= System.cmd(...) %> therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated. This issue affects ash_ai: from 0.1.0 before 1.0.0.
Title EEx template evaluation of prompt content in AshAi enables remote code execution
First Time appeared Ash-project
Ash-project ash Ai
Weaknesses CWE-94
CPEs cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*
Vendors & Products Ash-project
Ash-project ash Ai
References
Metrics cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Ash-project Ash Ai
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-08-31T16:01:41.879Z

Reserved: 2026-08-30T17:30:01.409Z

Link: CVE-2026-77956

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T01:16:49.563

Modified: 2026-08-31T16:19:12.900

Link: CVE-2026-77956

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T02:30:18Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')