Riskcovery

CVE-2026-77850

Stored XSS in AshAdmin relationship typeahead via unescaped label_field content

State
Published
Severity
8.4 High
Published
Aug 31, 2026
Updated
Aug 31, 2026
Reserved
Aug 31, 2026

Read the record on cve.org

Description

Stored Cross-site Scripting vulnerability in ash-project ash_admin executes attacker-supplied record content as script in an administrator's browser.

The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in <b> tags and rendering the whole string with Phoenix.HTML.raw/1. The highlighted value is the destination record's label_field, ordinary database content that is often written by lower-privileged users. Because raw/1 disables output escaping for the entire string, a stored label such as <img src=x onerror=...> runs as JavaScript in the admin's session as soon as a matching record appears in the dropdown, giving the attacker the admin's privileges over everything AshAdmin exposes. The fix HTML-escapes the label before inserting the highlight markup.

This issue affects ash_admin: from 0.13.0 before 1.3.1.

Scores

CVSSScoreVectorSource
4.08.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NEEF

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
ash_adminash-project
  • 0.13.0 to before 1.3.1Affected
ash_adminash-project
  • eb940f4d7d857ca49368ae847f586d01c6f5ad35 to before 07289191ccdac27dd70ab7c6413ed057bc7fdadeAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.