A flaw in the AshAi.ToolLoop component causes an infinite loop when all proposed tool calls are filtered out, resulting in continuous, identical requests being sent to the model and no progress in the conversation. The weakness is an infinite loop (CWE-835). An attacker who can influence the model's output, such as through prompt injection that produces missing or duplicate tool_call_ids, can trigger the loop. The consequence is a denial of service that consumes computational resources and can block further processing, affecting the availability of the application but not confidentiality or integrity.

The vulnerability affects the AshProject Ash_ai library, versions 0.6.0 through 0.9.x. Upgrading to 1.0.0 or later removes the flaw.

The CVSS score of 6.0 signals a medium‑severity risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to control or influence the model’s output to produce invalid or duplicate tool calls. While this does not readily lend itself to arbitrary code execution, the resulting denial of service can disrupt services that rely on Ash_ai and could be exploited in environments where the model output can be injected. The absence of an exploit probability metric suggests uncertainty, but the existence of an exploitable infinite loop warrants attention.