Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.9
CVE-2026-77956: AshAi prompt feature lets attackers run code on server
CVE-2026-77956 · published 2 months ago
Summary
The AshAi library versions before 1.0.0 let anyone send specially crafted text that the system treats as executable code. This means an unauthenticated user could cause the server to run arbitrary commands, potentially compromising data or operations. Upgrade to AshAi 1.0.0 or later, where only fixed templates are processed, and review any custom prompt handling to ensure it does not evaluate user‑supplied content.
What to do
- Update ash-project ash_ai to version 1.0.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | ash-project | ash_ai |
< 1.0.0 < e9948254b5659c1143b73dc2f59f457931e64514 |
| Hex | ash-project | ash_ai |
>= 0.1.0, < 1.0.0 Fix: upgrade to 1.0.0
|
Original advisory text
EEx template evaluation of prompt content in AshAi enables remote code execution
Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code.
AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -> ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as <%= System.cmd(...) %> therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.
This issue affects ash_ai: from 0.1.0 before 1.0.0.
AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -> ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as <%= System.cmd(...) %> therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.
This issue affects ash_ai: from 0.1.0 before 1.0.0.
References
- https://hex.pm/packages/ash_ai Product
- https://github.com URL
- https://repo.hex.pm URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77956... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-77956 Vendor Advisory
- https://github.com/ash-project/ash_ai Product
- https://cna.erlef.org/cves/CVE-2026-77956.html URL
- https://osv.dev/vulnerability/EEF-CVE-2026-77956 URL
- https://github.com/ash-project/ash_ai/security/advisories/GHSA-2g59-hg7m-qc83 Vendor Advisory
- https://github.com/ash-project/ash_ai/commit/e9948254b5659c1143b73dc2f59f457931e... Patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.9
High
Type
CWE-94Code Injection
Timeline
Published31 Aug 2026
Updated3 Nov 2026
First seen31 Aug 2026
Sources
CVE-2026-77956 · NVD
CVE-2026-77956 · MITRE
EEF-CVE-2026-77956 · OSV
GHSA-2g59-hg7m-qc83 · GHSA
CVE-2026-77956 · OSV
Track software like this
Free during beta