CVE-2026-80227

Name of the Vulnerable Software and Affected Versions ash sql versions 0.1.0 through 0.7.0

Description An incorrect comparison issue exists where a user can pad a string field with tab, newline, carriage-return, or form-feed characters to bypass trimmed uniqueness or equality checks. This occurs because the string trim/1 function compiles to REGEXP REPLACE patterns where the escape sequence s is treated as a single space (codepoint 32) rather than a full regex whitespace class. Consequently, the generated SQL removes only literal spaces, while the Elixir String.trim/1 function removes all whitespace characters. This discrepancy causes Ash filters, validations, or identities relying on string trim/1 to behave inconsistently depending on whether the expression is evaluated in memory or pushed down to the database, allowing padded input to bypass comparisons.

Recommendations Update ash sql to version 0.7.1 or later. As a temporary workaround, avoid using the string trim/1 function in filters, validations, calculations, or identities that process attacker-influenced string fields.