GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-82731 (GCVE-0-2026-82731)

Vulnerability from cvelistv5 – Published: 2026-09-01 02:09 – Updated: 2026-09-01 15:13
VLAI
Title
Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection
Summary
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redirect a generated client's request, and the credentials attached to it, to an unintended route or an external origin. The URL builders in lib/ash_typescript/typed_controller/codegen/route_renderer.ex replace each :param placeholder with a bare template interpolation and never call encodeURIComponent, so the value reaches executeTypedControllerRequest raw. A value containing ../ is normalised away by the fetch URL resolver and reaches a different route, while ? or # truncates the path and can smuggle or override query parameters. For a route whose path begins with a parameter, a value such as /evil.example.com/x yields the protocol-relative URL //evil.example.com/x, sending the request and the credentials from TypedControllerConfig to an attacker-controlled host. Nothing constrains the value at runtime: get_path_param_type/2 emits only a TypeScript type, which is erased. The query-string path is unaffected, since URLSearchParams.set encodes its own values. This issue affects ash_typescript: from 0.15.0 before 0.18.0.
Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:13 UTC
CWE
  • CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
Impacted products
Vendor Product Version CPE status
ash-project ash_typescript Affected: 0.15.0 , < 0.18.0 (semver)
    cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*
Create a notification for this product.
ash-project ash_typescript Affected: 6669e22ece34b4534e706a46d1842f01b68ee23a , < 5165f752f5f92b755d946f2d1ce750ff69083ffc (git)
    cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Peter Ullrich Peter Ullrich Torkild Gundersen Kjevik / Ash Project Jonatan Männchen / EEF
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82731",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T15:13:34.848553Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T15:13:54.605Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-6g23-p936-fm2f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshTypescript.TypedController.Codegen.RouteRenderer\u0027"
          ],
          "packageName": "ash_typescript",
          "packageURL": "pkg:hex/ash_typescript",
          "product": "ash_typescript",
          "programFiles": [
            "lib/ash_typescript/typed_controller/codegen/route_renderer.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshTypescript.TypedController.Codegen.RouteRenderer\u0027:build_url_template_to_variable/4"
            }
          ],
          "repo": "https://github.com/ash-project/ash_typescript",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "0.18.0",
              "status": "affected",
              "version": "0.15.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.AshTypescript.TypedController.Codegen.RouteRenderer\u0027"
          ],
          "packageName": "ash-project/ash_typescript",
          "packageURL": "pkg:github/ash-project/ash_typescript",
          "product": "ash_typescript",
          "programFiles": [
            "lib/ash_typescript/typed_controller/codegen/route_renderer.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.AshTypescript.TypedController.Codegen.RouteRenderer\u0027:build_url_template_to_variable/4"
            }
          ],
          "repo": "https://github.com/ash-project/ash_typescript",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "5165f752f5f92b755d946f2d1ce750ff69083ffc",
              "status": "affected",
              "version": "6669e22ece34b4534e706a46d1842f01b68ee23a",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe application ships a TypeScript client generated by AshTypescript for a typed-controller route taking a path parameter, and passes untrusted input as that parameter.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The application ships a TypeScript client generated by AshTypescript for a typed-controller route taking a path parameter, and passes untrusted input as that parameter."
            }
          ],
          "value": "The application ships a TypeScript client generated by AshTypescript for a typed-controller route taking a path parameter, and passes untrusted input as that parameter."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.18.0",
                  "versionStartIncluding": "0.15.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Torkild Gundersen Kjevik / Ash Project"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eURL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redirect a generated client\u0027s request, and the credentials attached to it, to an unintended route or an external origin.\u003c/p\u003e\n\u003cp\u003eThe URL builders in \u003ccode\u003elib/ash_typescript/typed_controller/codegen/route_renderer.ex\u003c/code\u003e replace each \u003ccode\u003e:param\u003c/code\u003e placeholder with a bare template interpolation and never call \u003ccode\u003eencodeURIComponent\u003c/code\u003e, so the value reaches \u003ccode\u003eexecuteTypedControllerRequest\u003c/code\u003e raw. A value containing \u003ccode\u003e../\u003c/code\u003e is normalised away by the fetch URL resolver and reaches a different route, while \u003ccode\u003e?\u003c/code\u003e or \u003ccode\u003e#\u003c/code\u003e truncates the path and can smuggle or override query parameters. For a route whose path begins with a parameter, a value such as \u003ccode\u003e/evil.example.com/x\u003c/code\u003e yields the protocol-relative URL \u003ccode\u003e//evil.example.com/x\u003c/code\u003e, sending the request and the credentials from \u003ccode\u003eTypedControllerConfig\u003c/code\u003e to an attacker-controlled host. Nothing constrains the value at runtime: \u003ccode\u003eget_path_param_type/2\u003c/code\u003e emits only a TypeScript type, which is erased.\u003c/p\u003e\n\u003cp\u003eThe query-string path is unaffected, since \u003ccode\u003eURLSearchParams.set\u003c/code\u003e encodes its own values.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_typescript: from 0.15.0 before 0.18.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redirect a generated client\u0027s request, and the credentials attached to it, to an unintended route or an external origin.\n\nThe URL builders in `lib/ash_typescript/typed_controller/codegen/route_renderer.ex` replace each `:param` placeholder with a bare template interpolation and never call `encodeURIComponent`, so the value reaches `executeTypedControllerRequest` raw. A value containing `../` is normalised away by the fetch URL resolver and reaches a different route, while `?` or `#` truncates the path and can smuggle or override query parameters. For a route whose path begins with a parameter, a value such as `/evil.example.com/x` yields the protocol-relative URL `//evil.example.com/x`, sending the request and the credentials from `TypedControllerConfig` to an attacker-controlled host. Nothing constrains the value at runtime: `get_path_param_type/2` emits only a TypeScript type, which is erased.\n\nThe query-string path is unaffected, since `URLSearchParams.set` encodes its own values.\n\nThis issue affects ash_typescript: from 0.15.0 before 0.18.0."
            }
          ],
          "value": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redirect a generated client\u0027s request, and the credentials attached to it, to an unintended route or an external origin.\n\nThe URL builders in lib/ash_typescript/typed_controller/codegen/route_renderer.ex replace each :param placeholder with a bare template interpolation and never call encodeURIComponent, so the value reaches executeTypedControllerRequest raw. A value containing ../ is normalised away by the fetch URL resolver and reaches a different route, while ? or # truncates the path and can smuggle or override query parameters. For a route whose path begins with a parameter, a value such as /evil.example.com/x yields the protocol-relative URL //evil.example.com/x, sending the request and the credentials from TypedControllerConfig to an attacker-controlled host. Nothing constrains the value at runtime: get_path_param_type/2 emits only a TypeScript type, which is erased.\n\nThe query-string path is unaffected, since URLSearchParams.set encodes its own values.\n\nThis issue affects ash_typescript: from 0.15.0 before 0.18.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-72",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-72 URL Encoding"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T02:09:38.801Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/ash-project/ash_typescript/security/advisories/GHSA-6g23-p936-fm2f"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-82731.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82731"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ash-project/ash_typescript/commit/5165f752f5f92b755d946f2d1ce750ff69083ffc"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-82731",
    "datePublished": "2026-09-01T02:09:38.801Z",
    "dateReserved": "2026-08-31T00:59:08.960Z",
    "dateUpdated": "2026-09-01T15:13:54.605Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-82731",
      "date": "2026-09-17",
      "epss": "0.00288",
      "percentile": "0.21452"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-82731\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-09-01T03:16:52.993\",\"lastModified\":\"2026-09-01T21:15:00.147\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redirect a generated client\u0027s request, and the credentials attached to it, to an unintended route or an external origin.\\n\\nThe URL builders in lib/ash_typescript/typed_controller/codegen/route_renderer.ex replace each :param placeholder with a bare template interpolation and never call encodeURIComponent, so the value reaches executeTypedControllerRequest raw. A value containing ../ is normalised away by the fetch URL resolver and reaches a different route, while ? or # truncates the path and can smuggle or override query parameters. For a route whose path begins with a parameter, a value such as /evil.example.com/x yields the protocol-relative URL //evil.example.com/x, sending the request and the credentials from TypedControllerConfig to an attacker-controlled host. Nothing constrains the value at runtime: get_path_param_type/2 emits only a TypeScript type, which is erased.\\n\\nThe query-string path is unaffected, since URLSearchParams.set encodes its own values.\\n\\nThis issue affects ash_typescript: from 0.15.0 before 0.18.0.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"ash-project\",\"product\":\"ash_typescript\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"ash_typescript\",\"cpes\":[\"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.AshTypescript.TypedController.Codegen.RouteRenderer\u0027\"],\"programFiles\":[\"lib/ash_typescript/typed_controller/codegen/route_renderer.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.AshTypescript.TypedController.Codegen.RouteRenderer\u0027:build_url_template_to_variable/4\"}],\"repo\":\"https://github.com/ash-project/ash_typescript\",\"packageURL\":\"pkg:hex/ash_typescript\",\"versions\":[{\"version\":\"0.15.0\",\"lessThan\":\"0.18.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"ash-project\",\"product\":\"ash_typescript\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"ash-project/ash_typescript\",\"cpes\":[\"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.AshTypescript.TypedController.Codegen.RouteRenderer\u0027\"],\"programFiles\":[\"lib/ash_typescript/typed_controller/codegen/route_renderer.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.AshTypescript.TypedController.Codegen.RouteRenderer\u0027:build_url_template_to_variable/4\"}],\"repo\":\"https://github.com/ash-project/ash_typescript\",\"packageURL\":\"pkg:github/ash-project/ash_typescript\",\"versions\":[{\"version\":\"6669e22ece34b4534e706a46d1842f01b68ee23a\",\"lessThan\":\"5165f752f5f92b755d946f2d1ce750ff69083ffc\",\"versionType\":\"git\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-01T15:13:34.848553Z\",\"id\":\"CVE-2026-82731\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-601\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-82731.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash_typescript/commit/5165f752f5f92b755d946f2d1ce750ff69083ffc\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash_typescript/security/advisories/GHSA-6g23-p936-fm2f\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-82731\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/ash_typescript/security/advisories/GHSA-6g23-p936-fm2f\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-82731\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-01T15:13:34.848553Z\"}}}], \"references\": [{\"url\": \"https://github.com/ash-project/ash_typescript/security/advisories/GHSA-6g23-p936-fm2f\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-01T15:13:50.085Z\"}}], \"cna\": {\"title\": \"Unescaped path parameters in AshTypescript generated TypeScript client allow request redirection\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Torkild Gundersen Kjevik / Ash Project\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-72\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-72 URL Encoding\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 2.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ash-project/ash_typescript\", \"vendor\": \"ash-project\", \"modules\": [\"\u0027Elixir.AshTypescript.TypedController.Codegen.RouteRenderer\u0027\"], \"product\": \"ash_typescript\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.15.0\", \"lessThan\": \"0.18.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/ash_typescript\", \"packageName\": \"ash_typescript\", \"programFiles\": [\"lib/ash_typescript/typed_controller/codegen/route_renderer.ex\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.AshTypescript.TypedController.Codegen.RouteRenderer\u0027:build_url_template_to_variable/4\"}]}, {\"cpes\": [\"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ash-project/ash_typescript\", \"vendor\": \"ash-project\", \"modules\": [\"\u0027Elixir.AshTypescript.TypedController.Codegen.RouteRenderer\u0027\"], \"product\": \"ash_typescript\", \"versions\": [{\"status\": \"affected\", \"version\": \"6669e22ece34b4534e706a46d1842f01b68ee23a\", \"lessThan\": \"5165f752f5f92b755d946f2d1ce750ff69083ffc\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/ash-project/ash_typescript\", \"packageName\": \"ash-project/ash_typescript\", \"programFiles\": [\"lib/ash_typescript/typed_controller/codegen/route_renderer.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.AshTypescript.TypedController.Codegen.RouteRenderer\u0027:build_url_template_to_variable/4\"}]}], \"references\": [{\"url\": \"https://github.com/ash-project/ash_typescript/security/advisories/GHSA-6g23-p936-fm2f\", \"tags\": [\"related\", \"vendor-advisory\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-82731.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-82731\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/ash-project/ash_typescript/commit/5165f752f5f92b755d946f2d1ce750ff69083ffc\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redirect a generated client\u0027s request, and the credentials attached to it, to an unintended route or an external origin.\\n\\nThe URL builders in lib/ash_typescript/typed_controller/codegen/route_renderer.ex replace each :param placeholder with a bare template interpolation and never call encodeURIComponent, so the value reaches executeTypedControllerRequest raw. A value containing ../ is normalised away by the fetch URL resolver and reaches a different route, while ? or # truncates the path and can smuggle or override query parameters. For a route whose path begins with a parameter, a value such as /evil.example.com/x yields the protocol-relative URL //evil.example.com/x, sending the request and the credentials from TypedControllerConfig to an attacker-controlled host. Nothing constrains the value at runtime: get_path_param_type/2 emits only a TypeScript type, which is erased.\\n\\nThe query-string path is unaffected, since URLSearchParams.set encodes its own values.\\n\\nThis issue affects ash_typescript: from 0.15.0 before 0.18.0.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eURL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redirect a generated client\u0027s request, and the credentials attached to it, to an unintended route or an external origin.\u003c/p\u003e\\n\u003cp\u003eThe URL builders in \u003ccode\u003elib/ash_typescript/typed_controller/codegen/route_renderer.ex\u003c/code\u003e replace each \u003ccode\u003e:param\u003c/code\u003e placeholder with a bare template interpolation and never call \u003ccode\u003eencodeURIComponent\u003c/code\u003e, so the value reaches \u003ccode\u003eexecuteTypedControllerRequest\u003c/code\u003e raw. A value containing \u003ccode\u003e../\u003c/code\u003e is normalised away by the fetch URL resolver and reaches a different route, while \u003ccode\u003e?\u003c/code\u003e or \u003ccode\u003e#\u003c/code\u003e truncates the path and can smuggle or override query parameters. For a route whose path begins with a parameter, a value such as \u003ccode\u003e/evil.example.com/x\u003c/code\u003e yields the protocol-relative URL \u003ccode\u003e//evil.example.com/x\u003c/code\u003e, sending the request and the credentials from \u003ccode\u003eTypedControllerConfig\u003c/code\u003e to an attacker-controlled host. Nothing constrains the value at runtime: \u003ccode\u003eget_path_param_type/2\u003c/code\u003e emits only a TypeScript type, which is erased.\u003c/p\u003e\\n\u003cp\u003eThe query-string path is unaffected, since \u003ccode\u003eURLSearchParams.set\u003c/code\u003e encodes its own values.\u003c/p\u003e\\n\u003cp\u003eThis issue affects ash_typescript: from 0.15.0 before 0.18.0.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"URL Redirection to Untrusted Site (\u0027Open Redirect\u0027) vulnerability in ash-project ash_typescript allows an attacker who controls a path-parameter value to redirect a generated client\u0027s request, and the credentials attached to it, to an unintended route or an external origin.\\n\\nThe URL builders in `lib/ash_typescript/typed_controller/codegen/route_renderer.ex` replace each `:param` placeholder with a bare template interpolation and never call `encodeURIComponent`, so the value reaches `executeTypedControllerRequest` raw. A value containing `../` is normalised away by the fetch URL resolver and reaches a different route, while `?` or `#` truncates the path and can smuggle or override query parameters. For a route whose path begins with a parameter, a value such as `/evil.example.com/x` yields the protocol-relative URL `//evil.example.com/x`, sending the request and the credentials from `TypedControllerConfig` to an attacker-controlled host. Nothing constrains the value at runtime: `get_path_param_type/2` emits only a TypeScript type, which is erased.\\n\\nThe query-string path is unaffected, since `URLSearchParams.set` encodes its own values.\\n\\nThis issue affects ash_typescript: from 0.15.0 before 0.18.0.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-601\", \"description\": \"CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"The application ships a TypeScript client generated by AshTypescript for a typed-controller route taking a path parameter, and passes untrusted input as that parameter.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe application ships a TypeScript client generated by AshTypescript for a typed-controller route taking a path parameter, and passes untrusted input as that parameter.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"The application ships a TypeScript client generated by AshTypescript for a typed-controller route taking a path parameter, and passes untrusted input as that parameter.\", \"base64\": false}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:ash-project:ash_typescript:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"0.18.0\", \"versionStartIncluding\": \"0.15.0\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-09-01T02:09:38.801Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-82731\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-01T15:13:54.605Z\", \"dateReserved\": \"2026-08-31T00:59:08.960Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-09-01T02:09:38.801Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.