AshAI Evaluates Model Output as Live Elixir Code
Unauthenticated code injection in ash-project ash_ai: AshAi.Actions.Prompt evaluates untrusted model-supplied content as live Elixir code, allowing RCE without authentication.
- Vendor
- ash-project
- Product
- ash_ai
- CVSS
- N/A
- EPSS (exploit probability)
- 0.3%
- Status
- patched
- Published
Is CVE-2026-77956 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-77956 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-22 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.3% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison
CVE-2026-77956 timeline
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-77956 is an improper code injection vulnerability in the AshAi.Actions.Prompt implementation in the ash-project ash_ai package for Elixir. The affected component evaluates model-supplied content as live Elixir code without sanitization or authorization checks. Because the endpoint is reachable without authentication, any network client able to reach the application can trigger arbitrary Elixir code execution with the privileges of the running process.
This vulnerability was disclosed by the Erlang Ecosystem Foundation CNA (ERLEF CNA) as part of a coordinated batch of 13 CVEs against ash-project packages published on August 31, 2026. It is part of a broader pattern in AI framework security: model output or user input being passed to an evaluation function without sufficient validation.
Affected package: ash_ai
Vendor advisory: cna.erlef.org/cves/CVE-2026-77956.html
Mitigation: Update to the patched version of ash_ai per the ERLEF CNA advisory. Applications should not expose AshAi.Actions.Prompt endpoints to untrusted network clients without authentication middleware. Review deployments for any endpoint reachable without credentials.
See the full ash-project disclosure roundup for the complete list of 13 CVEs patched in this batch.
Other ash-project CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-70395 Ash managed relationship lookup bypasses authorizationwrite-up | [ LOW ] | 2.1 | 0.2% | — |
| CVE-2026-69659 Ash keyset pagination cursor triggers node OOMwrite-up | [ MEDIUM ] | 5.9 | 0.4% | — |
