CVE-2026-82732: Vulnerability in ash_typescript Allows Bypassing Argument Constraints
Summary
CVE-2026-82732: Declared argument constraints not enforced on AshTypescript typed controller routes. Affects ash_typescript across 2 version ranges.
>= 0.15.0, < 0.18.0
>= 546a15e1a2d7dbf1df2d5a6ee4404bc3da87852e, < 21ab6f1229a4dccdb56bc37ed437d9672a0c4a4e
Fixed in 0.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ash_typescript is a library that facilitates the creation of typed controllers in Elixir applications, enabling developers to define routes with strict type constraints. This library aims to enhance type safety and reduce runtime errors by ensuring that only valid data is processed. However, a recent vulnerability has been identified that undermines these constraints, potentially allowing unauthorized access or incorrect data handling.
Vulnerability Detail
The vulnerability arises from improper input validation in the ash_typescript library, specifically in the AshTypescript.TypedController.RequestHandler. The method calls Ash.Type.cast_input/3, which only coerces input types without enforcing the declared constraints on the arguments. As a result, values outside the defined allowlist can be accepted, leading to potential privilege escalation or state-machine bypasses. This issue affects versions from 0.15.0 to before 0.18.0, allowing attackers to exploit the system by submitting invalid data that should have been restricted.
How To Fix
Latest published version: 0.19.2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.18.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually validate the input in your route handlers before processing it. For example, you can implement a check to ensure that the input adheres to the expected constraints before proceeding with the request handling.
Conclusion
The CVE-2026-82732 vulnerability in the ash_typescript library poses significant risks by allowing the bypass of declared argument constraints. It is crucial for developers using affected versions to update to the latest version to ensure proper input validation and maintain application security.
See every vulnerability recorded for ash_typescript →
FAQ
CVE-2026-82732 is a vulnerability in the ash_typescript library that allows attackers to bypass argument constraints on typed controller routes.
Versions of ash_typescript from 0.15.0 to before 0.18.0 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access, privilege escalation, or incorrect data processing due to the acceptance of invalid input.
To update the package, modify your mix.exs file to specify version 0.18.0 or later and run mix deps.update ash_typescript.
Related vulnerabilities
Recent vulnerabilities recorded for ash_typescript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
