AshTypescript.TypedController.RequestHandler bypasses declared argument constraints by only performing type casting and ignoring subsequent constraint checks. As a result, the system accepts values that violate allowlist, length, numeric bounds, or regex patterns, letting attackers inject values such as unauthorized roles, statuses, or sort orders. Because the endpoint then receives these unvalidated values, attackers can trigger privilege escalation or alter application state machines.

The flaw is present in the ash-project ash_typescript library for versions 0.15.0 through 0.17.x. Systems that integrate these versions into their web services or GenServers are vulnerable. Upgrading to version 0.18.0 or later removes the bug, as newer releases include a fix that calls Ash.Type.apply_constraints.

The CVSS score of 6.3 places the vulnerability in the moderate severity range, but the lack of an EPSS score means that available data does not indicate a high exploitation probability. The issue is not listed in CISA’s KEV catalog. The attack vector is remote; any HTTP client can send malformed payloads because the only enforcement is in generated TypeScript types, which does not affect raw HTTP traffic. An attacker can exploit this by sending specially crafted requests that bypass the constraints and gain elevated privileges or manipulate application state.