CVE-2026-67579 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-67579HIGH

ash-project ash — Filter expression injection via forged keyset pagination cursor in Ash

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   L   L   P   N   N   H   H   H    7.5   .0040   33.5     —

AFFECTED
  Product  Versions                                    Fixed
  ash      1.17.0 –                                    —
  ash      f8fadc67e67c955bb68b3a8d642be13e2b7e8ca9 –  —

TIMELINE
  Aug 9   Reserved by EEF
  Aug 12  EXPLOIT PUBLISHED — CVE-2026-67579 (ash-project ash). Public exploit reference added.
  Aug 12  Published (CNA: EEF)
  Aug 18  EXPLOIT PUBLISHED — CVE-2026-67579 (ash-project ash). Public exploit reference added.

CWE-89, CWE-502 · CNA: EEF · CVSS v4.0 · 4 references · NVD status: Analyzed

Description

Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex using non_executable_binary_to_term/2 with [:safe]. That guard blocks new atoms, funs, and ports, but not a struct built from atoms already interned in a running Ash application, so a decoded %Ash.Query.Call{} expression survives and is spliced into the keyset filter as a comparison value in do_filters/4 and evaluated. Because the cursor bypasses the Ash.Expr macro, the runtime never applies the private?/public? gate that would otherwise reject it. On AshPostgres the injected fragment is inlined into the SQL query; on the ETS and Simple data layers it is evaluated in-process as an arbitrary function call. This issue affects ash: from 1.17.0 before 3.31.3.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
August 9, 2026	Reserved	Reserved by EEF
August 12, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-67579 (ash-project ash). Public exploit reference added.
August 12, 2026	Published	Published (CNA: EEF)
August 18, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-67579 (ash-project ash). Public exploit reference added.

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
ash-project	ash	—	1.17.0	—
ash-project	ash	—	f8fadc67e67c955bb68b3a8d642be13e2b7e8ca9	—

Weaknesses

CWE-89 · CWE-502

References (4)

https://cna.erlef.org/cves/CVE-2026-67579.html [Third Party Advisory, Patch]
https://github.com/ash-project/ash/commit/91874dd5435bc0ffebd8a254acfa573b39b74520 [Patch]
https://github.com/ash-project/ash/security/advisories/GHSA-3gq3-9xm3-c8v3 [Vendor Advisory, Exploit, Patch]
https://osv.dev/vulnerability/EEF-CVE-2026-67579 [Third Party Advisory, Patch]

Authoritative record: CVE-2026-67579 at cve.org

Vendors: ash-project

Weaknesses: CWE-89 · CWE-502

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-67579 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.