CVE-2026-77970: AshPaperTrail Sensitive Information Exposure in Embedded Values
Summary
CVE-2026-77970: Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions. Affects ash_paper_trail across 2 version ranges.
>= 0.3.0, < 0.7.0
>= ffe5e03b14d26b73bff17f3eca811591788aba9c, < 0cd4acfe7f48397673d8594fb5e2cd0f1bda6e40
Fixed in 0.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshPaperTrail is a versioning library for the Ash framework, designed to track changes in resources and maintain a history of modifications. It allows developers to manage versioned data effectively, ensuring that changes can be audited and reverted if necessary. However, a vulnerability exists in versions prior to 0.7.0, where sensitive fields nested within embedded resources are not adequately redacted, leading to potential exposure of sensitive information.
Vulnerability Detail
The vulnerability identified as CVE-2026-77970 arises from the improper handling of sensitive attributes in AshPaperTrail. Specifically, the library's mechanisms for redacting sensitive information only apply to the top-level attributes of tracked resources. This oversight allows an attacker with read access to the version resource to retrieve sensitive data nested within embedded resources, unions, or lists. For instance, if an embedded resource contains a sensitive token, it may be stored in cleartext within the version table, posing a significant security risk.
How To Fix
Latest published version: 0.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually ensure that sensitive attributes are not included in the versioning process by avoiding the use of sensitive fields in embedded resources, unions, or lists until the package is updated.
Conclusion
CVE-2026-77970 presents a significant risk to applications using AshPaperTrail versions prior to 0.7.0, as it allows sensitive information to be exposed. It is crucial for developers to update to the patched version to mitigate this vulnerability and protect sensitive data.
See every vulnerability recorded for ash_paper_trail →
FAQ
CVE-2026-77970 is a vulnerability in AshPaperTrail that allows sensitive information to be exposed due to improper redaction of nested attributes.
The vulnerability affects AshPaperTrail versions from 0.3.0 up to, but not including, 0.7.0.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive information, such as tokens or credentials, which could lead to further exploitation of the application.
If an immediate update is not possible, consider implementing a workaround by avoiding the use of sensitive fields in versioned attributes until the package can be updated.
Related vulnerabilities
Recent vulnerabilities recorded for ash_paper_trail.
