CVE-2026-81852

Name of the Vulnerable Software and Affected Versions ash admin versions 0.10.8 through 1.3.0

Description The software uses a hardcoded, publicly known Content-Security-Policy (CSP) nonce, which undermines nonce-based CSP protections. When the ash admin/2 function in AshAdmin.Router is mounted without the :csp nonce assign key key, the nonces for images, styles, and scripts default to the constant value ash admin-Ed55GFnX. This value is a compile-time constant that is not rotated per request and is written into the nonce attribute of inline <style> and <script> tags. If a CSP script-src allow-lists this default value, an HTML-injection sink on an admin page can be used to execute inline scripts by reusing the known nonce.

Recommendations Update ash admin to version 1.3.1 or later. As a temporary mitigation, provide a unique value for the :csp nonce assign key when mounting ash admin/2 to avoid using the hardcoded default nonce.