CVE-2026-105283

Name of the Vulnerable Software and Affected Versions ash typescript versions 0.1.0 through 0.19.0

Description An unauthenticated attacker can read internal Elixir terms from an RPC error response by provoking an error that the error builder does not have a dedicated clause for. The function AshTypescript.Rpc.ErrorBuilder.build error response/1 in lib/ash typescript/rpc/error builder.ex renders pipeline error terms using inspect/1 and places the result in details.error of the client-facing error without redaction. This occurs through two primary request paths: when a struct-typed action argument contains an invalid nested value, causing cast map to struct/2 in lib/ash typescript/rpc/input formatter.ex to throw a raw Ash.Type cast error, or during field selection on a generic action returning a primitive, where format field type/1 inspects the full Ash.Info.Manifest.Type struct into vars.returnType. Consequently, any client accessing the RPC endpoint can retrieve internal state and terms from the error response by submitting malformed struct arguments or field selections.

Recommendations Update ash typescript to version 0.19.1 or later.