The vulnerability arises from Insufficiently Random Values in ash-project ash_admin, where a hardcoded CSP nonce (ash_admin-Ed55GFnX) is embedded into <style> and <script> tags on every response when the router is mounted without the :csp_nonce_assign_key option. Because the nonce never changes per request, an attacker who can inject HTML into an admin page can reuse the known nonce to execute inline JavaScript that the policy was meant to block. This allows cross‑site scripting within the administrative interface and constitutes a severity of low CVSS 2.1, but the impact is that attackers can run arbitrary scripts in the context of the admin user. The weakness is classified as CWE‑330, insufficient random values.

ash-project ash_admin 0.10.8 through 1.3.0 (before the 1.3.1 release) are affected. All builds before 1.3.1 default to the constant nonce when the :csp_nonce_assign_key is omitted.

The EPSS score is not available and the vulnerability is not listed in KEV. The CVSS rating of 2.1 indicates a low severity risk. Exploitation requires the ability to inject HTML into an admin‑level page and the application to use the default hardcoded nonce. Once satisfied, the attacker can include malicious inline scripts that bypass CSP restrictions. Because the nonce is publicly known, bypassing is straightforward; however, an attacker needs privileged access to the admin interface or a path that permits arbitrary HTTP content injection. Overall, the likelihood of exploitation is low to moderate given the limited attack surface and low CVSS score, but any admin page that accepts user input remains a risk vector.