{"apiVersion":"1.0","identifier":"CVE-2026-67579","description":"Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex using non_executable_binary_to_term/2 with [:safe]. That guard blocks new atoms, funs, and ports, but not a struct built from atoms already interned in a running Ash application, so a decoded %Ash.Query.Call{} expression survives and is spliced into the keyset filter as a comparison value in do_filters/4 and evaluated. Because the cursor bypasses the Ash.Expr macro, the runtime never applies the private?/public? gate that would otherwise reject it. On AshPostgres the injected fragment is inlined into the SQL query; on the ETS and Simple data layers it is evaluated in-process as an arbitrary function call. This issue affects ash: from 1.17.0 before 3.31.3.","publishedAt":"2026-08-12T20:17:48","lastModifiedAt":"2026-08-18T14:53:39","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67579","cvssScore":7.4,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00805,"riskScore":0.79,"affectedProduct":"ash","affectedVersions":">=1.17.0,<3.31.3","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-67579","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-67579","en":"https://www.redsauce.net/en/cves/CVE-2026-67579","fr":"https://www.redsauce.net/fr/cves/CVE-2026-67579","pt":"https://www.redsauce.net/pt/cves/CVE-2026-67579","de":"https://www.redsauce.net/de/cves/CVE-2026-67579","sk":"https://www.redsauce.net/sk/cves/CVE-2026-67579","el":"https://www.redsauce.net/el/cves/CVE-2026-67579"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-67579"}}