CVE-2026-78693
Gravedad CVSS v4.0:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
30/08/2026
Última modificación:
30/08/2026
Descripción
*** Pendiente de traducción *** Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an application configured its error_handler to redact.<br />
<br />
In AshGraphql.Errors, each error is passed to the configured error_handler and the returned map is merged with the pre-handler path via Map.put_new(handled, :path, path). Because put_new defers to the handler only when the handler itself set :path, a sanitizing handler that returns a fresh map or deletes :path has that decision reverted. The re-injected path comes from build_error_path/5, which falls back to raw internal Ash attribute and argument names when no field_names mapping is configured. A validation failure on a non-exposed or nested field therefore returns internal names in the GraphQL error path, defeating the application&#39;s redaction.<br />
<br />
This issue affects ash_graphql: from 1.9.0 before 1.11.0.
Impacto
Puntuación base 4.0
6.90
Gravedad 4.0
MEDIA