Answer in brief
CVE-2026-78230 records a Medium severity (CVSS 6.0) vulnerability in AshAi aggregate tool can read field-policy-protected fields. The current sources do not mark it as known exploited. The current feed maps ash-project/ash_ai (generic), ash-project/ash_ai (generic), ash-project/ash-project/ash_ai (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.0. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps ash-project/ash_ai (generic), ash-project/ash_ai (generic), ash-project/ash-project/ash_ai (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| ash-project/ash_aigeneric | >=2ba234b50946a3b8116190c8467f9f4dfa5edce7 <9c02de581625c342c9870a672830bff28c1d701e | 9c02de581625c342c9870a672830bff28c1d701e |
| ash-project/ash_aigeneric | >=0.1.0 <1.0.3 | 1.0.3 |
| ash-project/ash-project/ash_aigeneric | >=2ba234b50946a3b8116190c8467f9f4dfa5edce7 <9c02de581625c342c9870a672830bff28c1d701e | 9c02de581625c342c9870a672830bff28c1d701e |
Published upstream
Sep 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 8, 2026
AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned records (replacing them with %Ash.ForbiddenField{}), but that redaction does not apply to aggregate values. A tool caller could therefore read a field the calling actor's field policies forbid by requesting it as an aggregate; min/max in particular return an actual field value. This includes fields that are public? true but restricted per-actor by a field policy, such as sensitive PII. The tool's existing check only required the field to be public, which is a separate axis from per-actor field-policy authorization. The fix authorizes the aggregated field against the resource's field policies, so aggregating over a field the actor may not see is refused or scoped to the rows where it is visible. This issue affects ash_ai: from 0.1.0 before 1.0.3.
Quoted source text, attributed separately from HOL analysis.