Ash-Project Ash Lua vulnerabilities

2 CVEs affecting Ash-Project Ash Lua, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-78216, published 2026-09-08.

More from Ash-Project.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-82586, published 2026-09-07. High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days. Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash…
• CVE-2026-78216, published 2026-09-08. Medium severity, CVSS 6.0. EPSS: 0.4% chance of exploitation in the next 30 days. AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg) that builds an ad-hoc Ash.Query.Aggregate over a named…