CVE-2026-82681

Name of the Vulnerable Software and Affected Versions ash admin versions 0.3.0-rc.0 through 1.3.0

Description An improper encoding or escaping of output issue exists where an attacker controlling a record's string primary key can rewrite the target of row-action links. The Table, DataTable, and Show components construct row-action URLs using raw string interpolation, inserting the primary key, table, domain, and resource names into the query string without URL-encoding. Since Plug.Conn.Query resolves duplicate parameters using a last-wins logic and the primary key is interpolated last, a stored key containing characters like & or # can inject parameters to override the link or truncate the query into a fragment. This allows an attacker to redirect an administrator from an edit action to a destroy form or another arbitrary resource.

Recommendations Update ash admin to version 1.3.1 or later.