Jisung Chae

**Name of the Vulnerable Software and Affected Versions** ash versions 1.17.0 through 3.31.2 **Description** An unauthenticated attacker can inject a filter expression using a forged keyset pagination cursor. This occurs because read actions with keyset pagination decode client-supplied `page[:after]` or `page[:before]` cursors in the `decode values/2` function within `lib/ash/page/keyset.ex` using `non executable binary to term/2` with `[:safe]`. While this guard blocks new atoms, funs, and ports, it does not block structs built from atoms already interned in a running application. Consequently, a decoded `%Ash.Query.Call{}` expression can be spliced into the keyset filter as a comparison value in `do filters/4` and evaluated. Since the cursor bypasses the `Ash.Expr` macro, the runtime fails to apply the `private?/public?` gate. The impact varies by data layer: AshPostgres allows SQL injection, while ETS and Simple data layers allow the expression to be evaluated in-process as an arbitrary function call. **Recommendations** Update ash to version 3.31.3 or later.

**Name of the Vulnerable Software and Affected Versions** ash-project ash versions 1.17.0 through 3.31.0 **Description** An uncontrolled resource consumption issue exists where an attacker can exhaust node memory using a crafted keyset pagination cursor. Read actions utilizing keyset pagination deserialize client-supplied cursors via the `decode values/2` function in `lib/ash/page/keyset.ex`. This process base64-decodes the value and passes it to `:erlang.binary to term/2` without size bounding. Because the Erlang external term format supports zlib-compressed payloads, the decoder may inflate a small cursor into tens of megabytes of heap memory. Since the software only encodes cursors as uncompressed, the decoder accepts term shapes that the encoder does not produce. Multiple concurrent requests can aggregate these allocations and cause the node to terminate. This involves the `page[:after]` and `page[:before]` variables. **Recommendations** Update ash-project ash to version 3.31.1 or later.

**Name of the Vulnerable Software and Affected Versions** ash-project ash versions 1.52.0-rc.11 through 3.31.0 **Description** Improper Neutralization of Special Elements in Data Query Logic allows an attacker to forge a relationship to a record they cannot name and recover the secret value used for lookup. This occurs when `manage relationship` is used with `on lookup: :relate` on a `belongs to` relationship, as the client-supplied lookup value is passed to `Ash.Query.filter/2` without being cast to the attribute type. Consequently, a nested map submitted instead of a scalar is interpreted as a filter predicate rather than a literal, transforming a specific record lookup into a query for any record matching a condition. Additionally, the omission of `Ash.Query.limit(1)` allows `Ash.read one/2` to distinguish between no match, one match, and several matches, creating an oracle for the lookup value. Authorization remains unaffected as the destination read policy still applies. **Recommendations** Update ash-project ash to version 3.31.1 or later.