ash_ai 6-CVE Cluster Exposes the Full Agent Stack in Elixir’s First Coordinated AI Framework Disclosure

On August 30, 2026, maintainer zachdaniel disclosed six vulnerabilities in ash_ai, an LLM toolbox for the Elixir-based Ash Framework, all fixed in version 1.0.0, including a critical remote code execution flaw (CVE-2026-77956, CVSS 8.9) that lets unauthenticated attackers execute arbitrary Elixir code via prompt content. The cluster also includes an MCP origin validation bypass (CVE-2026-81315, CVSS 7.4), an authorization bypass (CVE-2026-82564, CVSS 7.1), and three lower-severity issues, all discovered by researcher PJUllrich using LLM-assisted security research.

On August 30, 2026, maintainer zachdaniel disclosed a cluster of six vulnerabilities affecting ash ai, an LLM toolbox extension for the Elixir-based Ash Framework. This release marks the first coordinated security disclosure within the Elixir/Ash ecosystem. The vulnerabilities, which span the entire agent stack—from prompt evaluation and tool execution to embedding pipelines and orchestration—were all addressed in version 1.0.0. The most critical issue, CVE-2026-77956 https://github.com/ash-project/ash ai/security/advisories/GHSA-2g59-hg7m-qc83 CVSS 8.9 , is a remote code execution vulnerability in AshAi.Actions.Prompt. The framework is designed to treat user-provided prompt content as executable code via EEx.eval string/2. Because this occurs before any model request, an unauthenticated attacker can execute arbitrary Elixir code by supplying malicious form content. This is an architectural design choice rather than a traditional injection bug, highlighting the risks inherent in frameworks that prioritize template-based flexibility over strict input isolation. The cluster also includes CVE-2026-81315 https://github.com/ash-project/ash ai/security/advisories/GHSA-c92r-f3rr-q49h CVSS 7.4 , an origin validation error in the Model Context Protocol /glossary/model-context-protocol-mcp/ server implementation. By manipulating the Host header and the X-Forwarded-Proto header, an attacker can bypass origin checks, allowing a malicious web page to issue cross-site requests to a user’s local MCP server. This mirrors the DNS-rebinding vulnerability class previously observed in Paperclip and other MCP implementations, confirming that the Elixir/BEAM ecosystem is subject to the same architectural weaknesses as other language stacks. A novel attack vector emerged in CVE-2026-82564 https://github.com/ash-project/ash ai/security/advisories/GHSA-jg86-xh36-h5xc CVSS 7.1 , which allows for authorization bypass. The vulnerability exists in AshAi.Tool.Execution, where nested JSON operands are parsed as predicate expressions. Because the filter-building code passes raw client JSON directly to Ash.Query.do filter/2, an unauthenticated MCP caller can retarget updates or destroys to arbitrary records. This specific flaw demonstrates how identity-based tool execution models can be subverted when input validation fails to account for nested data structures. The remaining vulnerabilities include CVE-2026-75760 https://github.com/ash-project/ash ai/security/advisories/GHSA-p5cr-mmmf-6w39 CVSS 7.1 , which leaks API keys and provider URLs through raw error messages; CVE-2026-82579 https://github.com/ash-project/ash ai/security/advisories/GHSA-rcx7-x2w5-mmc2 CVSS 6.0 , an infinite loop in the tool orchestration logic; and CVE-2026-82580 https://github.com/ash-project/ash ai/security/advisories/GHSA-5747-6mpw-6m9c CVSS 5.3 , which discloses database schema information via exception messages. These issues illustrate the agent amplification effect /glossary/agent-amplification-effect/ , where minor implementation errors in error handling or loop logic can be weaponized to extract sensitive system metadata. Notably, all six CVEs were discovered by researcher PJUllrich using LLM-assisted security research—an agent-native signal of AI tools identifying vulnerabilities within the frameworks designed to build them. This trend reinforces the ongoing MCP wave that has seen high-severity disclosures across various platforms, including Splunk, HashiCorp, and ServiceNow. The breadth of this cluster—covering RCE, DNS rebinding, auth bypass, credential leakage, and DoS—underscores the complexity of securing agentic toolboxes. As these extensions continue to integrate deeper into application frameworks, the surface area for exploitation grows, necessitating more rigorous validation of how frameworks handle user-controlled input and internal tool orchestration.