Skip to content
Fencer Vulns
medium 6.3

CVE-2026-77950 json

RPC error handler fails open in AshTypescript, disclosing unredacted errors

published 2026-09-01 2 mo ago modified 2026-09-08 2 mo ago also EEF-CVE-2026-77950 , GHSA-mjr7-r3rf-x963 , EUVD-2026-68925

cvss
6.3
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match.

apply_error_handler/3 in lib/ash_typescript/rpc/errors.ex is the only hook an application has for redacting or suppressing errors before they reach the client, with a nil return dropping the error entirely. Its rescue clause logs a warning and then returns the original, pre-handler error map. Error handlers are conventionally written as pattern-matching functions over expected error shapes, so an unmatched shape raises FunctionClauseError and the raw transformed error, including any secrets carried in vars, is emitted instead. An intent to suppress an error becomes an intent to publish it. The rescue catches exceptions only, so a handler that throws or exits still propagates.

This issue affects ash_typescript: from 0.8.0 before 0.18.0.

Patch / fix

  • hex ash_typescript 0.18.0
  • ash-project ash_typescript 0.18.0

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/ash-project/ash_typescript/security/advisories/GHSA-mjr7-r3rf-x963 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
hex ash_typescript
>=0.8.0, <0.18.0
0.18.0

Affected products

  • ash-project ash_typescript

Classification

Weakness
  • CWE-209 Generation of Error Message Containing Sensitive Information

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.