CVE-2026-82731

Name of the Vulnerable Software and Affected Versions ash typescript versions 0.15.0 through 0.17.x

Description An Open Redirect issue exists where an attacker controlling a path-parameter value can redirect a generated client's request and its associated credentials to an unintended route or an external origin. This occurs because URL builders in lib/ash typescript/typed controller/codegen/route renderer.ex use bare template interpolation for :param placeholders without calling encodeURIComponent, allowing raw values to reach executeTypedControllerRequest. Specifically, values containing ../ are normalized by the fetch URL resolver to reach different routes, while ? or # can truncate paths to smuggle or override query parameters. If a route path begins with a parameter, a value like /evil.example.com/x creates a protocol-relative URL, sending requests and TypedControllerConfig credentials to an attacker-controlled host. The get path param type/2 function only emits a TypeScript type that is erased at runtime, providing no constraint on the value.

Recommendations Update ash typescript to version 0.18.0 or later.