Zach Daniel / Ash Project

Unhandled KeyError in AshGraphql relay node resolution crashes queries via an unknown type segment

Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain

AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data

Broken access control in AshGraphql subscription batcher applies authorization suppression to only the first notification

exists/2 predicate silently dropped on limited relationships with a parent() filter in AshSql

Same-named aggregates with differing filters are conflated in AshSql

Unescaped backslash allows LIKE wildcard injection in AshSql string search

SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql

Unbounded handle_error recursion enables denial of service in AshOban triggers

Job argument injection via :args overrides primary_key and tenant in AshOban