AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -> ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as <%= System.cmd(...) %> therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.
This issue affects ash_ai: from 0.1.0 before 1.0.0.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ash-project | ash_ai | unaffected |
|
||||||
| ash-project | ash_ai | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 31 Aug 2026 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -> ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as <%= System.cmd(...) %> therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated. This issue affects ash_ai: from 0.1.0 before 1.0.0. | |
| Title | EEx template evaluation of prompt content in AshAi enables remote code execution | |
| First Time appeared |
Ash-project
Ash-project ash Ai |
|
| Weaknesses | CWE-94 | |
| CPEs | cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Ash-project
Ash-project ash Ai |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: EEF
Published:
Updated: 2026-08-31T00:56:26.440Z
Reserved: 2026-08-30T17:30:01.409Z
Link: CVE-2026-77956
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-31T01:16:49.563
Modified: 2026-08-31T01:16:49.563
Link: CVE-2026-77956
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-31T02:30:18Z
-
CWE-94
Improper Control of Generation of Code ('Code Injection')