CriticalVulnerability
CVE-2026-77956: ash_ai code injection in prompt actions allows unauthenticated Elixir execution
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-77956
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
CVE-2026-77956 is a code injection flaw in ash-project ash_ai, versions from 0.1.0 before 1.0.0. AshAi.Actions.Prompt passes prompt content through EEx.eval_string/2, so when a prompt action builds its text from request data, attacker-controlled input is compiled and run as Elixir. A remote, unauthenticated client can thus execute arbitrary Elixir code on the server, before any model request is made.
Mitigation
The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.
Related items
- MediumFake OpenAI, SpaceX events used to steal Microsoft, Google accountsSimilar attack · BleepingComputer
- HighGHSA-64vx-6h2c-rjh7: Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCESimilar attack · GitHub Advisory Database
- MediumHacking on Autopilot: Inside ARTEX Cybercrime CampaignsSimilar attack · Check Point Research
- MediumCVE-2026-122160: myshell-ai AIlice HuggingFace Model Wrapper untrusted model loadingSimilar attack · NVD/CVE Database
- MediumCVE-2026-122159: Edge0-AI Audio8_TTS path traversal via slow_decode_models argumentSimilar attack · NVD/CVE Database