{"id":6225,"date":"2026-09-04T18:48:52","date_gmt":"2026-09-04T10:48:52","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-67579"},"modified":"2026-09-04T18:48:52","modified_gmt":"2026-09-04T10:48:52","slug":"cve-2026-67579","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-67579","title":{"rendered":"CVE-2026-67579 [HIGH] &#8211; Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticat"},"content":{"rendered":"<p>Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer.<\/p>\n<p>Read actions with keyset pagination decode the client-supplied page[:after] or page[:before] cursor in decode_values\/2 in lib\/ash\/page\/keyset.ex using non_executable_binary_to_term\/2 with [:safe]. That guard blocks new atoms, funs, and ports, but not a struct built from atoms already interned in a running Ash application, so a decoded %Ash.Query.Call{} expression survives and is spliced into the keyset filter as a comparison value in do_filters\/4 and evaluated. Because the cursor bypasses the Ash.Expr macro, the runtime never applies the private?\/public? gate that would otherwise reject it. On AshPostgres the injected fragment is inlined into the SQL query; on the ETS and Simple data layers it is evaluated in-process as an arbitrary function call.<\/p>\n<p>This issue affects ash: from 1.17.0 before 3.31.3.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injectio<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6225","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6225"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6225"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}