CVE-2026-82681: Query-Parameter Injection in AshAdmin via Unencoded String Primary Keys
Summary
CVE-2026-82681: Query-parameter injection in AshAdmin row-action links via unencoded string primary keys. Affects ash_admin across 2 version ranges.
>= 0.3.0-rc.0, < 1.3.1
>= b214535f0cc012e36ca621e643bf8f7b133ba354, < 8e8ef91e8ba07498053887c6212f8b0f08178df6
Fixed in 1.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AshAdmin is a component of the Ash framework that provides an administrative interface for managing resources. It allows users to perform actions on data records through a web interface. The package is designed to facilitate CRUD operations and is often utilized in applications that require a backend management system. However, due to its reliance on user-defined string primary keys, it is susceptible to query-parameter injection vulnerabilities.
Vulnerability Detail
The vulnerability arises from improper encoding or escaping of output in AshAdmin, allowing an attacker to manipulate row-action links by controlling a record's string primary key. This can lead to unauthorized actions, such as redirecting an admin to a destroy form instead of an edit form, or even accessing arbitrary resources. The issue is exacerbated by the way query parameters are processed, where duplicate parameters are resolved in a last-wins manner, allowing crafted keys to override intended actions.
How To Fix
Latest published version: 1.3.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any user-defined string primary keys are validated and sanitized before being used in query parameters. This can help mitigate the risk of injection until the package is updated.
Conclusion
CVE-2026-82681 presents a significant risk for applications using AshAdmin with user-defined string primary keys. It is crucial to update to the patched version 1.3.1 to mitigate this vulnerability and ensure the security of your application.
See every vulnerability recorded for ash_admin →
FAQ
CVE-2026-82681 is a vulnerability in the AshAdmin component of the Ash framework that allows for query-parameter injection through unencoded string primary keys.
If your application uses AshAdmin with user-defined string primary keys, an attacker could exploit this vulnerability to redirect admin actions or access unauthorized resources.
The vulnerability affects AshAdmin versions from 0.3.0-rc.0 up to, but not including, 1.3.1.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 2.0, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ash_admin.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.