CVE-2026-82733: ash_typescript Route Handler Exposes Sensitive Data in Error Responses
Summary
CVE-2026-82733: Route handler return value echoed into AshTypescript error response. Affects ash_typescript across 2 version ranges.
>= 0.15.0, < 0.18.0
>= 546a15e1a2d7dbf1df2d5a6ee4404bc3da87852e, < dec80e29543f96e43eeece8501376562f17ac638
Fixed in 0.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ash_typescript is a library designed to facilitate the integration of Ash Framework with TypeScript, enabling developers to create typed controllers for their applications. It provides a structured way to handle HTTP requests and responses while ensuring type safety. However, a vulnerability has been identified that allows sensitive internal application data to be exposed through error messages returned by route handlers.
Vulnerability Detail
The vulnerability arises from the way ash_typescript handles return values from route handlers. When a handler returns a value that is not a %Plug.Conn{}, the library passes this value to a function that interpolates it directly into the error response. This can lead to sensitive information, such as hashed passwords and tokens, being included in the HTTP 500 response body. This issue is particularly concerning as it allows unauthenticated attackers to read internal application data, contradicting the library's intended error handling practices.
How To Fix
Latest published version: 0.19.2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.18.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a custom error handler that ensures only generic error messages are returned, preventing sensitive data from being exposed. For example, you can modify your controller to catch exceptions and return a standard error message:
defmodule MyAppWeb.MyController do
use MyAppWeb, :controller
def action(conn, params) do
try do
# Your action logic here
rescue
_ ->
conn
|> put_status(:internal_server_error)
|> json(%{error: "An unexpected error occurred."})
end
end
end
Conclusion
CVE-2026-82733 is a significant vulnerability in the ash_typescript library that can lead to the exposure of sensitive data through error messages. It is crucial for developers using affected versions to update to the patched version to ensure the security of their applications. Implementing a custom error handler can serve as a temporary measure while the update is being applied.
See every vulnerability recorded for ash_typescript →
FAQ
CVE-2026-82733 is a vulnerability in the ash_typescript library that allows sensitive internal application data to be exposed through error messages returned by route handlers.
If your application uses ash_typescript versions between 0.15.0 and 0.18.0, it may expose sensitive information in HTTP error responses, which can be exploited by attackers.
You should update your ash_typescript package to version 0.18.0 or later to mitigate the vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application for this vulnerability using the Vulert playground without any signup.
The CVSS score for CVE-2026-82733 is 6.3, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for ash_typescript.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
