ash-project/ash_lua vulnerabilities
CVEs whose affected-version data names the ash-project/ash_lua package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-78216Medium· 6.0AshLua exposes Ash read actions to Lua scripts run through an eval action
AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash fi…
▾ Sunlitash-project · ash_luaEPSS 0.25%via NVD
CVE-2026-82586High· 8.2Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manife…
Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manife…
▾ Twilightash-project · ash_luaEPSS 0.33%via NVD