AshAI Evaluates Model Output as Live Elixir Code
Unauthenticated code injection in ash-project ash_ai: AshAi.Actions.Prompt evaluates untrusted model-supplied content as live Elixir code, allowing RCE without authentication.
- Vendor
- ash-project
- Product
- ash_ai
- CVSS
- N/A
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
CVE-2026-77956 is an improper code injection vulnerability in the AshAi.Actions.Prompt implementation in the ash-project ash_ai package for Elixir. The affected component evaluates model-supplied content as live Elixir code without sanitization or authorization checks. Because the endpoint is reachable without authentication, any network client able to reach the application can trigger arbitrary Elixir code execution with the privileges of the running process.
This vulnerability was disclosed by the Erlang Ecosystem Foundation CNA (ERLEF CNA) as part of a coordinated batch of 13 CVEs against ash-project packages published on August 31, 2026. It is part of a broader pattern in AI framework security: model output or user input being passed to an evaluation function without sufficient validation.
Affected package: ash_ai
Vendor advisory: cna.erlef.org/cves/CVE-2026-77956.html
Mitigation: Update to the patched version of ash_ai per the ERLEF CNA advisory. Applications should not expose AshAi.Actions.Prompt endpoints to untrusted network clients without authentication middleware. Review deployments for any endpoint reachable without credentials.
See the full ash-project disclosure roundup for the complete list of 13 CVEs patched in this batch.
