The flaw lies in how ash_sql's string_trim/1 function translates to SQL; it removes only space characters and leaves tabs, newlines, carriage returns, and form feeds untouched, whereas the equivalent Elixir function String.trim/1 removes all whitespace. This discrepancy allows an attacker to pad a string field with hidden whitespace so that a uniqueness or equality check performed at the database level passes while the same check in memory fails, or vice versa. Consequently an attacker can insert duplicate records that the application believes are unique, or bypass validation logic that relies on trimmed comparisons.

Affected products are the AshSQL library from the AshProject. Versions from 0.1.0 up to (but not including) 0.7.1 contain the flaw. No other vendors or products are listed, and the vulnerability is tied specifically to the ash_sql component.

The CVSS score is 2.1, reflecting a low severity assessment. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. An attacker could exploit the issue by supplying a string containing hidden whitespace characters through the application's input—or via any API that writes to the relevant database column—and the system may accept duplicate or malformed data. Because the attack requires only normal data insertion, it is likely achievable via normal remote access if the application allows direct input, but the low CVSS indicates that the overall risk to confidentiality or availability is modest. Nonetheless, any use of uniqueness constraints or strict equality checks in your system should be reviewed for this inconsistency.