What’s Vulnerable › Products

ash-project ash_ai vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your ash-project ash_ai version is affected

Latest ash-project ash_ai vulnerabilities

• CVE-2026-78230 — AshAi aggregate tool can read field-policy-protected fields (CVSS 6.0)
• CVE-2026-82580 — AshAi echoes raw tool exception messages into the conversation, disclosing internal details (CVSS 5.3)
• CVE-2026-82579 — AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service (CVSS 6.0)
• CVE-2026-82564 — Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records (CVSS 7.1)
• CVE-2026-75760 — AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error (CVSS 7.1)
• CVE-2026-81315 — MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header (CVSS 7.4)
• CVE-2026-77956 — EEx template evaluation of prompt content in AshAi enables remote code execution (CVSS 8.9)