CVE-2026-82733

Name of the Vulnerable Software and Affected Versions ash typescript versions 0.15.0 through 0.17.0

Description An unauthenticated attacker can read internal application data from an HTTP 500 response body. This occurs when a typed-controller route handler returns a value other than %Plug.Conn{}, causing the dispatch/3 function in lib/ash typescript/typed controller/request handler.ex to pass the value to unexpected return/2. This function interpolates inspect(value, limit: 50) directly into the response message. Because the limit option only bounds elements per collection and not the entire term, handlers returning terms like {:error, %User{}} or a changeset may serialize full field sets—including hashed passwords, tokens, and tenant identifiers—into the JSON error returned to the caller.

Recommendations Update ash typescript to version 0.18.0 or later.