CVE-2026-77950

Name of the Vulnerable Software and Affected Versions ash typescript versions 0.8.0 through 0.17.x

Description An unauthenticated attacker can obtain unredacted internal error data by triggering an error shape that the configured error handler does not match. The apply error handler/3 function in lib/ash typescript/rpc/errors.ex serves as the primary mechanism for redacting or suppressing errors before they reach the client. Because error handlers typically use pattern-matching, an unmatched shape triggers a FunctionClauseError. The rescue clause then logs a warning and returns the original error map, which may contain sensitive secrets within vars, effectively publishing information that was intended to be suppressed.

Recommendations Update ash typescript to version 0.18.0 or later.