CVE-2026-77956

CVE-2026-77956 is a code injection flaw (CWE-94) in the ash_ai package for the Ash Framework in which prompt action content is evaluated through EEx.eval_string/2, compiling attacker-supplied text as Elixir source. When a prompt action's text is built from action arguments or other request data, an unauthenticated client who can reach that prompt action can embed code (e.g., inline EEx/Elixir expressions) that executes on the server before any model request is even made. Successful exploitation yields arbitrary code execution on the host running the application, with high impact on confidentiality, integrity, and availability. All ash_ai releases from 0.1.0 through versions before 1.0.0 are affected. No public proof-of-concept is known, it is not in CISA KEV, and EPSS estimates only a 0.2% probability of exploitation within 30 days, so no in-the-wild exploitation is currently reported.

What to do: Upgrade ash_ai to 1.0.0 or later, where function-supplied prompt content is no longer evaluated as EEx and only statically configured templates are evaluated. As an interim mitigation, audit prompt actions for text built from action arguments or other untrusted request data and remove or sanitize attacker-controllable content in those prompts. If no upgrade path exists, restrict access to affected prompt actions (e.g., require authentication or network-level controls) since exploitation requires only reachability, not credentials.