CVE-2026-105283
Vulnerabilidad de Generación de Mensaje de Error Conteniendo Información Sensible en ash-project ash_typescript que permite a un atacante no autenticado leer términos internos de Elixir desde una respuesta de error RPC al provocar un error para el cual el generador de errores no tiene una cláusula dedicada.
AshTypescript.Rpc.ErrorBuilder.build_error_response/1 en lib/ash_typescript/rpc/error_builder.ex renderiza un término de error de tubería que no coincide con ninguna cláusula específica con inspect/1 y coloca el resultado en details.error del error orientado al cliente.
Leer descripción completaMostrar menos
Las excepciones de Ash siguen una ruta separada en AshTypescript.Rpc.Errors donde los casos no controlados se ocultan detrás de un errorId, pero estos respaldos no tienen redacción, por lo que cualquier término que lleve llega a la respuesta HTTP o de canal. Dos rutas de solicitud le entregan tales términos: un argumento de acción tipado como estructura con un valor anidado inválido, donde cast_map_to_struct/2 en lib/ash_typescript/rpc/input_formatter.ex lanza el error de conversión de Ash.Type sin procesar al generador, y selección de campo en una acción genérica que devuelve un primitivo, donde format_field_type/1 inspecciona la estructura completa Ash.Info.Manifest.Type en vars.returnType. Los nombres de módulos de recursos en vars.resource no se tratan como sensibles y están fuera del alcance.
Este problema afecta a ash_typescript: desde 0.1.0 anteriormente a 0.19.1.
Traducción automática del texto original de NVD (en inglés).
CVSS
- Puntuación base
- 6.3
- Versión
- 4.0
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.32 %
- Percentil entre todas las CVEs puntuadas
- 23
- Fecha de la puntuación
- 23/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access85 % - Impacto principal
T1005Data from Local Systemcollection80 %
Vulnerabilidad de divulgación de información en aplicación expuesta (AV:N, sin autenticación). Atacante remoto provoca errores para leer términos internos de Elixir en respuestas RPC (CWE-209: Error Message Containing Sensitive Information).
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-209
Referencias
Mostrar las 6 referencias
- https://cna.erlef.org/cves/CVE-2026-105283.html
- https://github.com/ash-project/ash_typescript/commit/4b3c65203ee78dc992d6d2e6559625c5460a01cd
- https://github.com/ash-project/ash_typescript/commit/8e204ce34e24a158cf22a2dac4d53c44716c9e30
- https://github.com/ash-project/ash_typescript/security/advisories/GHSA-7gxc-w225-f7f3
- https://osv.dev/vulnerability/EEF-CVE-2026-105283
- https://github.com/ash-project/ash_typescript/security/advisories/GHSA-7gxc-w225-f7f3
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-105283",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-105283",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-10-16T16:50:44.234803Z"
}
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "NOT_DEFINED",
"baseScore": 6.3,
"Automatable": "NOT_DEFINED",
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"exploitMaturity": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"subIntegrityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"modules": [
"'Elixir.AshTypescript.Rpc.ErrorBuilder'",
"'Elixir.AshTypescript.Rpc.InputFormatter'",
"'Elixir.AshTypescript.Rpc'"
],
"product": "ash_typescript",
"versions": [
{
"status": "affected",
"version": "0.1.0",
"lessThan": "0.19.1",
"versionType": "semver"
}
],
"packageURL": "pkg:hex/ash_typescript",
"packageName": "ash_typescript",
"programFiles": [
"lib/ash_typescript/rpc/error_builder.ex",
"lib/ash_typescript/rpc/input_formatter.ex",
"lib/ash_typescript/rpc.ex"
],
"collectionURL": "https://repo.hex.pm",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.AshTypescript.Rpc.ErrorBuilder':build_error_response/1"
},
{
"name": "'Elixir.AshTypescript.Rpc.ErrorBuilder':format_field_type/1"
},
{
"name": "'Elixir.AshTypescript.Rpc.InputFormatter':cast_map_to_struct/2"
},
{
"name": "'Elixir.AshTypescript.Rpc':run_action/3"
},
{
"name": "'Elixir.AshTypescript.Rpc':validate_action/3"
}
]
},
{
"cpes": [
"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/ash-project/ash_typescript",
"vendor": "ash-project",
"modules": [
"'Elixir.AshTypescript.Rpc.ErrorBuilder'",
"'Elixir.AshTypescript.Rpc.InputFormatter'",
"'Elixir.AshTypescript.Rpc'"
],
"product": "ash_typescript",
"versions": [
{
"status": "affected",
"version": "8e204ce34e24a158cf22a2dac4d53c44716c9e30",
"lessThan": "4b3c65203ee78dc992d6d2e6559625c5460a01cd",
"versionType": "git"
}
],
"packageURL": "pkg:github/ash-project/ash_typescript",
"packageName": "ash-project/ash_typescript",
"programFiles": [
"lib/ash_typescript/rpc/error_builder.ex",
"lib/ash_typescript/rpc/input_formatter.ex",
"lib/ash_typescript/rpc.ex"
],
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.AshTypescript.Rpc.ErrorBuilder':build_error_response/1"
},
{
"name": "'Elixir.AshTypescript.Rpc.ErrorBuilder':format_field_type/1"
},
{
"name": "'Elixir.AshTypescript.Rpc.InputFormatter':cast_map_to_struct/2"
},
{
"name": "'Elixir.AshTypescript.Rpc':run_action/3"
},
{
"name": "'Elixir.AshTypescript.Rpc':validate_action/3"
}
]
}
]
}
],
"published": "2026-10-12T12:17:12.447",
"references": [
{
"url": "https://cna.erlef.org/cves/CVE-2026-105283.html",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/ash-project/ash_typescript/commit/4b3c65203ee78dc992d6d2e6559625c5460a01cd",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/ash-project/ash_typescript/commit/8e204ce34e24a158cf22a2dac4d53c44716c9e30",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-7gxc-w225-f7f3",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-105283",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-7gxc-w225-f7f3",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"description": [
{
"lang": "en",
"value": "CWE-209"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for.\n\nAshTypescript.Rpc.ErrorBuilder.build_error_response/1 in lib/ash_typescript/rpc/error_builder.ex renders a pipeline error term that matches no specific clause with inspect/1 and places the result in details.error of the client-facing error. Ash exceptions take a separate path in AshTypescript.Rpc.Errors where unhandled cases are redacted behind an errorId, but these fallbacks have no redaction, so whatever the term carries reaches the HTTP or channel response. Two request paths hand it such terms: a struct-typed action argument with an invalid nested value, where cast_map_to_struct/2 in lib/ash_typescript/rpc/input_formatter.ex throws the raw Ash.Type cast error into the builder, and field selection on a generic action that returns a primitive, where format_field_type/1 inspects the full Ash.Info.Manifest.Type struct into vars.returnType. Resource module names in vars.resource are not treated as sensitive and are out of scope.\n\nThis issue affects ash_typescript: from 0.1.0 before 0.19.1."
}
],
"lastModified": "2026-10-16T17:17:23.207",
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}