CVE-2026-77850

CVE-2026-77850 is a stored cross-site scripting flaw (CWE-79) in AshAdmin, the admin dashboard for the Elixir Ash Framework, affecting versions from 0.13.0 before 1.3.1. The relationship typeahead components AshAdmin.Components.Resource.RelationshipField and AshAdmin.Components.Resource.ManagedRelationshipSelectField highlight the matched search term by wrapping it in tags and rendering the entire label string through Phoenix.HTML.raw/1, which disables HTML output escaping; the rendered label is the destination record's label_field, ordinary database content that lower-privileged users can often write. When an administrator uses the typeahead and a matching record whose label contains injected markup appears in the dropdown, the injected JavaScript executes in the admin's browser session, giving the attacker the admin's privileges over everything AshAdmin exposes. Any application running an affected ash_admin version where untrusted or low-privilege users can influence a related record's label_field and administrators use these relationship components is affected. No public proof-of-concept is known, it is not in CISA KEV, and EPSS estimates roughly a 0.3% probability of exploitation within 30 days (20th percentile).

What to do: Upgrade ash_admin to 1.3.1 or later, which HTML-escapes the label before inserting the highlight markup. Until then, restrict write access to fields used as label_field on related records, keep AshAdmin on internal or access-restricted networks, and have administrators avoid the relationship typeahead/managed-relationship selects for records whose labels can be set by lower-privileged users. Treat any stored markup in label fields as potentially executable in an admin's browser session.