CVE-2026-82732

Name of the Vulnerable Software and Affected Versions ash typescript versions 0.15.0 through 0.17.x

Description Improper input validation in typed-controller routes allows a remote attacker to submit argument values that bypass declared allowlists or bounds. The AshTypescript.TypedController.RequestHandler function in lib/ash typescript/typed controller/request handler.ex utilizes Ash.Type.cast input/3 but fails to call Ash.Type.apply constraints/3. Consequently, constraints such as one of, max length, min, max, and match are not enforced, allowing values outside the intended range to reach the route handler. This discrepancy occurs because while the generated TypeScript types reflect these constraints, other HTTP clients can ignore them. Additionally, the failure to apply constraints prevents empty-string to nil normalization, allowing empty strings to bypass allow nil?: false checks for required arguments. This can lead to privilege escalation or state-machine bypass when constraints are used to gate roles, statuses, or sort directions.

Recommendations Update ash typescript to version 0.18.0 or later.