ash_typescript 0.19.1 Redacts Internal RPC Error Details
Tech GuruQuick Answer
Ash Project published GHSA-7gxc-w225-f7f3 for ash_typescript 0.1.0 through 0.19.0. Upgrade to 0.19.1, review exposed RPC actions and prior error telemetry, confirm internal terms are no longer returned, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory ash_typescript RPC endpoints and actions with struct-typed inputs or primitive-return field selection, deploy 0.19.1, exercise malformed requests in a controlled test, confirm client responses are redacted, and review logs or monitoring for prior probing.
Last verified: 2026-10-12 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | ash_typescript RPC endpoints |
|---|---|
| Advisory | GHSA-7gxc-w225-f7f3 / CVE-2026-105283 |
| CVE | CVE-2026-105283 |
| Authoritative release date | 2026-10-12 11:15:40 UTC |
| Authority revision date | 2026-10-12 11:15:40 UTC |
| Affected versions | ash_typescript 0.1.0 through versions before 0.19.1 when an exposed RPC action accepts a struct-typed argument or a generic action permits field selection on a primitive return type. |
| Fixed version | ash_typescript 0.19.1 |
| CVSS base score | 6.3 (CVSS v4.0, EEF CNA record) |
| CVSS severity | Medium |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Unhandled pipeline error terms could be inspected into client-facing RPC responses, exposing internal Elixir terms when a caller submits malformed struct input or certain field selections.
What To Validate Now
- Inventory. Locate ash_typescript RPC endpoints deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: ash_typescript 0.1.0 through versions before 0.19.1 when an exposed RPC action accepts a struct-typed argument or a generic action permits field selection on a primitive return type. Do not infer applicability from product family or severity alone.
- Remediate. Apply ash_typescript 0.19.1 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the resulting version or managed-service state, exercise representative functionality and recovery paths, monitor for regressions, and document exceptions.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The advisory scopes resource module names out of sensitive treatment, but other pipeline state may have reached responses. Avoid reproducing the flaw against production data and protect captured test responses as potentially sensitive. Preserve the authority snapshot, asset and owner records, before-and-after versions, change approval, installation output, validation results, exceptions, and rollback evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
