CVE-2026-80227: Vulnerability in ash_sql Allows Unintended String Comparisons
Summary
CVE-2026-80227: SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql. Affects ash_sql across 2 version ranges.
>= 0.1.0, < 0.7.1
>= dd092ed273dec7bd2194352f24a39229fc8ae68b, < 1b11b5d8bc5321e2e6acac21594ef08f61986117
Fixed in 0.7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ash_sql is an Elixir library that facilitates SQL interactions for applications built with the Ash framework. It provides a way to define and execute queries against a database while maintaining the integrity of the data models. This package is designed to handle various data types and ensure that operations such as filtering and validation are performed correctly. However, a recent vulnerability has been identified that affects how string comparisons are handled, potentially leading to security issues.
Vulnerability Detail
The vulnerability arises from an incorrect implementation of the string_trim function in ash_sql, which only removes literal spaces from strings when executing SQL queries. Unlike Elixir's String.trim function, which removes all whitespace characters (including tabs, newlines, and carriage returns), the SQL implementation fails to account for these characters. As a result, an attacker can manipulate string fields by padding them with non-space whitespace characters, allowing them to bypass uniqueness and equality checks. This discrepancy can lead to unintended behavior, such as registering near-duplicate values in the database or allowing unauthorized access to data.
How To Fix
Latest published version: 0.8.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually validate and trim strings in your application before they are processed by ash_sql. For example, you can implement a custom validation function that uses Elixir's String.trim function to ensure that all whitespace characters are removed from user inputs before they reach the database.
Conclusion
The CVE-2026-80227 vulnerability in the ash_sql package poses a significant risk by allowing attackers to manipulate string comparisons through whitespace characters. It is crucial to update to the patched version to mitigate this risk and ensure the integrity of your application's data handling.
See every vulnerability recorded for ash_sql →
FAQ
CVE-2026-80227 is a vulnerability in the ash_sql package that allows for unintended string comparisons due to improper handling of whitespace characters in SQL queries.
If your application uses ash_sql and relies on string comparisons, it may be susceptible to attacks where an attacker can manipulate string fields to bypass checks for uniqueness or equality.
The vulnerability affects ash_sql versions from 0.1.0 up to, but not including, 0.7.1.
You can use Vulert, a tool that monitors open-source vulnerabilities, to check if your application is affected by this vulnerability. Visit Vulert Scanner to use the Vulert playground without signing up.
If you cannot update the package right away, implement a manual validation process to trim strings using Elixir's String.trim function before they are processed by ash_sql.
Related vulnerabilities
Recent vulnerabilities recorded for ash_sql.
