CVE-2026-77956: Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthentic

A code injection vulnerability in ash_ai allows unauthenticated attackers to execute arbitrary Elixir code (a programming language) on a server. The vulnerability occurs because the system uses EEx.eval_string/2 (a template evaluator that treats input as code) to process user-supplied prompt text, meaning an attacker can embed malicious commands that get executed before any AI model even processes the request.