Refine your search
4 vulnerabilities found for ash_phoenix by ash-project
CVE-2026-82725 (GCVE-0-2026-82725)
Vulnerability from cvelistv5
Published
2026-08-31 03:09
Modified
2026-08-31 15:49
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Summary
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data.
AshPhoenix.FilterForm resolved every relationship hop in the user-supplied path with Ash.Resource.Info.related/2, which traverses private relationships, and only checked the terminal field for publicity. parse_path_and_field/2 also rewrote a field naming a relationship into an extra path segment, so field=some_private_rel was accepted too. Both path and field come straight from form params, and the resulting ref went to Ash.Query.do_filter/2 without the public-only enforcement of Ash.Filter.parse_input/2. The fix resolves each hop with Ash.Resource.Info.public_relationship/2, rejecting the first non-public hop, and requires the terminal field to be public.
This issue affects ash_phoenix: from 0.6.0-rc.1 before 2.3.25.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ash-project | ash_phoenix |
Version: 0.6.0-rc.1 ≤ cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:* |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82725",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T15:49:19.535082Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T15:49:46.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-7xhg-xphm-f458"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPhoenix.FilterForm\u0027"
],
"packageName": "ash_phoenix",
"packageURL": "pkg:hex/ash_phoenix",
"product": "ash_phoenix",
"programFiles": [
"lib/ash_phoenix/filter_form/filter_form.ex"
],
"repo": "https://github.com/ash-project/ash_phoenix",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.3.25",
"status": "affected",
"version": "0.6.0-rc.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPhoenix.FilterForm\u0027"
],
"packageName": "ash-project/ash_phoenix",
"packageURL": "pkg:github/ash-project/ash_phoenix",
"product": "ash_phoenix",
"programFiles": [
"lib/ash_phoenix/filter_form/filter_form.ex"
],
"repo": "https://github.com/ash-project/ash_phoenix",
"vendor": "ash-project",
"versions": [
{
"lessThan": "a3691a3cb0947e8f2dc2c3cbff138a3e6197a15b",
"status": "affected",
"version": "06875682999938f607c970e71b6a80af90e18b3d",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe resource exposes an \u003ccode\u003eAshPhoenix.FilterForm\u003c/code\u003e whose params the attacker controls, and has a non-public relationship to data that should not be filterable.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The resource exposes an `AshPhoenix.FilterForm` whose params the attacker controls, and has a non-public relationship to data that should not be filterable."
}
],
"value": "The resource exposes an AshPhoenix.FilterForm whose params the attacker controls, and has a non-public relationship to data that should not be filterable."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.25",
"versionStartIncluding": "0.6.0-rc.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshPhoenix.FilterForm\u003c/code\u003e resolved every relationship hop in the user-supplied \u003ccode\u003epath\u003c/code\u003e with \u003ccode\u003eAsh.Resource.Info.related/2\u003c/code\u003e, which traverses private relationships, and only checked the terminal field for publicity. \u003ccode\u003eparse_path_and_field/2\u003c/code\u003e also rewrote a \u003ccode\u003efield\u003c/code\u003e naming a relationship into an extra path segment, so \u003ccode\u003efield=some_private_rel\u003c/code\u003e was accepted too. Both \u003ccode\u003epath\u003c/code\u003e and \u003ccode\u003efield\u003c/code\u003e come straight from form params, and the resulting ref went to \u003ccode\u003eAsh.Query.do_filter/2\u003c/code\u003e without the public-only enforcement of \u003ccode\u003eAsh.Filter.parse_input/2\u003c/code\u003e. The fix resolves each hop with \u003ccode\u003eAsh.Resource.Info.public_relationship/2\u003c/code\u003e, rejecting the first non-public hop, and requires the terminal field to be public.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_phoenix: from 0.6.0-rc.1 before 2.3.25.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data.\n\n`AshPhoenix.FilterForm` resolved every relationship hop in the user-supplied `path` with `Ash.Resource.Info.related/2`, which traverses private relationships, and only checked the terminal field for publicity. `parse_path_and_field/2` also rewrote a `field` naming a relationship into an extra path segment, so `field=some_private_rel` was accepted too. Both `path` and `field` come straight from form params, and the resulting ref went to `Ash.Query.do_filter/2` without the public-only enforcement of `Ash.Filter.parse_input/2`. The fix resolves each hop with `Ash.Resource.Info.public_relationship/2`, rejecting the first non-public hop, and requires the terminal field to be public.\n\nThis issue affects ash_phoenix: from 0.6.0-rc.1 before 2.3.25."
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data.\n\nAshPhoenix.FilterForm resolved every relationship hop in the user-supplied path with Ash.Resource.Info.related/2, which traverses private relationships, and only checked the terminal field for publicity. parse_path_and_field/2 also rewrote a field naming a relationship into an extra path segment, so field=some_private_rel was accepted too. Both path and field come straight from form params, and the resulting ref went to Ash.Query.do_filter/2 without the public-only enforcement of Ash.Filter.parse_input/2. The fix resolves each hop with Ash.Resource.Info.public_relationship/2, rejecting the first non-public hop, and requires the terminal field to be public.\n\nThis issue affects ash_phoenix: from 0.6.0-rc.1 before 2.3.25."
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T03:09:25.850Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-7xhg-xphm-f458"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82725.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82725"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_phoenix/commit/a3691a3cb0947e8f2dc2c3cbff138a3e6197a15b"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82725",
"datePublished": "2026-08-31T03:09:25.850Z",
"dateReserved": "2026-08-31T00:59:08.960Z",
"dateUpdated": "2026-08-31T15:49:46.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82724 (GCVE-0-2026-82724)
Vulnerability from cvelistv5
Published
2026-08-31 03:07
Modified
2026-08-31 15:54
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-863 - Incorrect Authorization
Summary
Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.
AshPhoenix.LiveView.SubdomainHook.on_mount/4 attached a handle_params hook to assign the tenant and then immediately called handle_subdomain in the same on_mount. The tenant assign is only written when LiveView later runs handle_params, strictly after on_mount returns, so handle_subdomain read an unset assign and ran as apply(m, f, [socket, nil | a]). A consumer gate that halts when the user does not belong to the tenant instead evaluated nil, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs handle_subdomain inside the handle_params hook with the real tenant on every navigation.
This issue affects ash_phoenix: from 2.1.26 before 2.3.25.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ash-project | ash_phoenix |
Version: 2.1.26 ≤ cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:* |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82724",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T15:53:54.952218Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T15:54:49.058Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-39c8-xcwr-gqff"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPhoenix.LiveView.SubdomainHook\u0027"
],
"packageName": "ash_phoenix",
"packageURL": "pkg:hex/ash_phoenix",
"product": "ash_phoenix",
"programFiles": [
"lib/ash_phoenix/live_view/subdomain_hook.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPhoenix.LiveView.SubdomainHook\u0027:on_mount/4"
}
],
"repo": "https://github.com/ash-project/ash_phoenix",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.3.25",
"status": "affected",
"version": "2.1.26",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPhoenix.LiveView.SubdomainHook\u0027"
],
"packageName": "ash-project/ash_phoenix",
"packageURL": "pkg:github/ash-project/ash_phoenix",
"product": "ash_phoenix",
"programFiles": [
"lib/ash_phoenix/live_view/subdomain_hook.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPhoenix.LiveView.SubdomainHook\u0027:on_mount/4"
}
],
"repo": "https://github.com/ash-project/ash_phoenix",
"vendor": "ash-project",
"versions": [
{
"lessThan": "b396e1aa5c6bdec39255f19cf938b539e6d28b71",
"status": "affected",
"version": "9a5ea4d377bc263de321d79574872a3dfc4fb541",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application uses \u003ccode\u003eAshPhoenix.LiveView.SubdomainHook\u003c/code\u003e with a \u003ccode\u003ehandle_subdomain\u003c/code\u003e callback as a tenant-scoped authorization gate.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application uses `AshPhoenix.LiveView.SubdomainHook` with a `handle_subdomain` callback as a tenant-scoped authorization gate."
}
],
"value": "The application uses AshPhoenix.LiveView.SubdomainHook with a handle_subdomain callback as a tenant-scoped authorization gate."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.25",
"versionStartIncluding": "2.1.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIncorrect Authorization vulnerability in ash-project ash_phoenix invokes the \u003ccode\u003eSubdomainHook\u003c/code\u003e authorization callback with a \u003ccode\u003enil\u003c/code\u003e tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshPhoenix.LiveView.SubdomainHook.on_mount/4\u003c/code\u003e attached a \u003ccode\u003ehandle_params\u003c/code\u003e hook to assign the tenant and then immediately called \u003ccode\u003ehandle_subdomain\u003c/code\u003e in the same \u003ccode\u003eon_mount\u003c/code\u003e. The tenant assign is only written when LiveView later runs \u003ccode\u003ehandle_params\u003c/code\u003e, strictly after \u003ccode\u003eon_mount\u003c/code\u003e returns, so \u003ccode\u003ehandle_subdomain\u003c/code\u003e read an unset assign and ran as \u003ccode\u003eapply(m, f, [socket, nil | a])\u003c/code\u003e. A consumer gate that halts when the user does not belong to the tenant instead evaluated \u003ccode\u003enil\u003c/code\u003e, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs \u003ccode\u003ehandle_subdomain\u003c/code\u003e inside the \u003ccode\u003ehandle_params\u003c/code\u003e hook with the real tenant on every navigation.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_phoenix: from 2.1.26 before 2.3.25.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the `SubdomainHook` authorization callback with a `nil` tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.\n\n`AshPhoenix.LiveView.SubdomainHook.on_mount/4` attached a `handle_params` hook to assign the tenant and then immediately called `handle_subdomain` in the same `on_mount`. The tenant assign is only written when LiveView later runs `handle_params`, strictly after `on_mount` returns, so `handle_subdomain` read an unset assign and ran as `apply(m, f, [socket, nil | a])`. A consumer gate that halts when the user does not belong to the tenant instead evaluated `nil`, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs `handle_subdomain` inside the `handle_params` hook with the real tenant on every navigation.\n\nThis issue affects ash_phoenix: from 2.1.26 before 2.3.25."
}
],
"value": "Incorrect Authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce.\n\nAshPhoenix.LiveView.SubdomainHook.on_mount/4 attached a handle_params hook to assign the tenant and then immediately called handle_subdomain in the same on_mount. The tenant assign is only written when LiveView later runs handle_params, strictly after on_mount returns, so handle_subdomain read an unset assign and ran as apply(m, f, [socket, nil | a]). A consumer gate that halts when the user does not belong to the tenant instead evaluated nil, either crashing or taking a permissive branch, and it was never re-run once the real subdomain was assigned or on later navigations. The fix runs handle_subdomain inside the handle_params hook with the real tenant on every navigation.\n\nThis issue affects ash_phoenix: from 2.1.26 before 2.3.25."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T03:07:57.455Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-39c8-xcwr-gqff"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82724.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82724"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_phoenix/commit/b396e1aa5c6bdec39255f19cf938b539e6d28b71"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Broken access control in AshPhoenix SubdomainHook via a nil tenant in handle_subdomain"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82724",
"datePublished": "2026-08-31T03:07:57.455Z",
"dateReserved": "2026-08-31T00:59:08.960Z",
"dateUpdated": "2026-08-31T15:54:49.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82726 (GCVE-0-2026-82726)
Vulnerability from cvelistv5
Published
2026-08-31 03:05
Modified
2026-08-31 14:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header.
AshPhoenix.Helpers.get_subdomain/2 stripped the root domain with String.replace(host, ~r/.?#{root_host}/, ""). The root host was interpolated raw, so each . became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With root_host example.com, Host: foo.exampleXcom.attacker.net returned the tenant foo.attacker.net. A metacharacter-bearing or nil root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so TENANT.EXAMPLE.COM and EXAMPLE.COM slipped past the root-host allowlist. conn.host comes from the client Host header. The fix matches the root host case-insensitively and only as an exact trailing suffix.
This issue affects ash_phoenix: from 2.1.26 before 2.3.25.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ash-project | ash_phoenix |
Version: 2.1.26 ≤ cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:* |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82726",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T14:47:10.055608Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T14:47:35.274Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-rpf8-q9jh-qxrr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPhoenix.Helpers\u0027"
],
"packageName": "ash_phoenix",
"packageURL": "pkg:hex/ash_phoenix",
"product": "ash_phoenix",
"programFiles": [
"lib/ash_phoenix/helpers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPhoenix.Helpers\u0027:get_subdomain/2"
}
],
"repo": "https://github.com/ash-project/ash_phoenix",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.3.25",
"status": "affected",
"version": "2.1.26",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPhoenix.Helpers\u0027"
],
"packageName": "ash-project/ash_phoenix",
"packageURL": "pkg:github/ash-project/ash_phoenix",
"product": "ash_phoenix",
"programFiles": [
"lib/ash_phoenix/helpers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPhoenix.Helpers\u0027:get_subdomain/2"
}
],
"repo": "https://github.com/ash-project/ash_phoenix",
"vendor": "ash-project",
"versions": [
{
"lessThan": "8306f29e77526840c89f3cd244996ce7c0fa2cda",
"status": "affected",
"version": "9a5ea4d377bc263de321d79574872a3dfc4fb541",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application uses subdomain-based multitenancy via \u003ccode\u003eAshPhoenix.Helpers.get_subdomain/2\u003c/code\u003e (for example through \u003ccode\u003eAshPhoenix.LiveView.SubdomainHook\u003c/code\u003e) to select the tenant from the request host.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application uses subdomain-based multitenancy via `AshPhoenix.Helpers.get_subdomain/2` (for example through `AshPhoenix.LiveView.SubdomainHook`) to select the tenant from the request host."
}
],
"value": "The application uses subdomain-based multitenancy via AshPhoenix.Helpers.get_subdomain/2 (for example through AshPhoenix.LiveView.SubdomainHook) to select the tenant from the request host."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.25",
"versionStartIncluding": "2.1.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePermissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted \u003ccode\u003eHost\u003c/code\u003e header.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshPhoenix.Helpers.get_subdomain/2\u003c/code\u003e stripped the root domain with \u003ccode\u003eString.replace(host, ~r/.?#{root_host}/, \"\")\u003c/code\u003e. The root host was interpolated raw, so each \u003ccode\u003e.\u003c/code\u003e became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With \u003ccode\u003eroot_host\u003c/code\u003e \u003ccode\u003eexample.com\u003c/code\u003e, \u003ccode\u003eHost: foo.exampleXcom.attacker.net\u003c/code\u003e returned the tenant \u003ccode\u003efoo.attacker.net\u003c/code\u003e. A metacharacter-bearing or \u003ccode\u003enil\u003c/code\u003e root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so \u003ccode\u003eTENANT.EXAMPLE.COM\u003c/code\u003e and \u003ccode\u003eEXAMPLE.COM\u003c/code\u003e slipped past the root-host allowlist. \u003ccode\u003econn.host\u003c/code\u003e comes from the client \u003ccode\u003eHost\u003c/code\u003e header. The fix matches the root host case-insensitively and only as an exact trailing suffix.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_phoenix: from 2.1.26 before 2.3.25.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted `Host` header.\n\n`AshPhoenix.Helpers.get_subdomain/2` stripped the root domain with `String.replace(host, ~r/.?#{root_host}/, \"\")`. The root host was interpolated raw, so each `.` became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With `root_host` `example.com`, `Host: foo.exampleXcom.attacker.net` returned the tenant `foo.attacker.net`. A metacharacter-bearing or `nil` root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so `TENANT.EXAMPLE.COM` and `EXAMPLE.COM` slipped past the root-host allowlist. `conn.host` comes from the client `Host` header. The fix matches the root host case-insensitively and only as an exact trailing suffix.\n\nThis issue affects ash_phoenix: from 2.1.26 before 2.3.25."
}
],
"value": "Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header.\n\nAshPhoenix.Helpers.get_subdomain/2 stripped the root domain with String.replace(host, ~r/.?#{root_host}/, \"\"). The root host was interpolated raw, so each . became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With root_host example.com, Host: foo.exampleXcom.attacker.net returned the tenant foo.attacker.net. A metacharacter-bearing or nil root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so TENANT.EXAMPLE.COM and EXAMPLE.COM slipped past the root-host allowlist. conn.host comes from the client Host header. The fix matches the root host case-insensitively and only as an exact trailing suffix.\n\nThis issue affects ash_phoenix: from 2.1.26 before 2.3.25."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-625",
"description": "CWE-625 Permissive Regular Expression",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "CWE-178 Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T03:05:38.612Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-rpf8-q9jh-qxrr"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82726.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82726"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_phoenix/commit/8306f29e77526840c89f3cd244996ce7c0fa2cda"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82726",
"datePublished": "2026-08-31T03:05:38.612Z",
"dateReserved": "2026-08-31T00:59:08.960Z",
"dateUpdated": "2026-08-31T14:47:35.274Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82727 (GCVE-0-2026-82727)
Vulnerability from cvelistv5
Published
2026-08-31 03:03
Modified
2026-08-31 14:49
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Summary
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.
When AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix's parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{"_union_type" => "nope", "password" => "..."} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.
This issue affects ash_phoenix: from 1.2.17 before 2.3.25.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ash-project | ash_phoenix |
Version: 1.2.17 ≤ cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:* |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82727",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T14:49:02.912896Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T14:49:25.154Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-5xf4-hgcq-xw7v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPhoenix.Form.Auto\u0027"
],
"packageName": "ash_phoenix",
"packageURL": "pkg:hex/ash_phoenix",
"product": "ash_phoenix",
"programFiles": [
"lib/ash_phoenix/form/auto.ex"
],
"repo": "https://github.com/ash-project/ash_phoenix",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.3.25",
"status": "affected",
"version": "1.2.17",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPhoenix.Form.Auto\u0027"
],
"packageName": "ash-project/ash_phoenix",
"packageURL": "pkg:github/ash-project/ash_phoenix",
"product": "ash_phoenix",
"programFiles": [
"lib/ash_phoenix/form/auto.ex"
],
"repo": "https://github.com/ash-project/ash_phoenix",
"vendor": "ash-project",
"versions": [
{
"lessThan": "0c1775c3cf8988f9abd10a8f92315afc5f06f16d",
"status": "affected",
"version": "a3436fcc321e3b34c242cceaf62c3c92bc1a452b",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application renders an \u003ccode\u003eAshPhoenix.Form\u003c/code\u003e with a union field, and submitted params (which may carry secrets) reach logs, crash reports or the error page.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application renders an `AshPhoenix.Form` with a union field, and submitted params (which may carry secrets) reach logs, crash reports or the error page."
}
],
"value": "The application renders an AshPhoenix.Form with a union field, and submitted params (which may carry secrets) reach logs, crash reports or the error page."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.25",
"versionStartIncluding": "1.2.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGeneration of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\u003c/p\u003e\n\u003cp\u003eWhen \u003ccode\u003eAshPhoenix.Form.Auto\u003c/code\u003e builds a union sub-form and the submitted \u003ccode\u003e_union_type\u003c/code\u003e does not match a configured type, both raise sites built the message with \u003ccode\u003einspect(params, pretty: true)\u003c/code\u003e, embedding the full untrusted param map, and also inspected the internal union \u003ccode\u003econstraints[:types]\u003c/code\u003e. Because the message is constructed by the library rather than Phoenix\u0027s parameter logger, \u003ccode\u003econfig :phoenix, :filter_parameters\u003c/code\u003e never redacts it. An attacker controls both the trigger and the contents: submitting \u003ccode\u003e%{\"_union_type\" =\u0026gt; \"nope\", \"password\" =\u0026gt; \"...\"}\u003c/code\u003e puts the password verbatim in the raised message. The fix reports only the offending \u003ccode\u003e_union_type\u003c/code\u003e and the valid type names, dropping the param and constraints dumps.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_phoenix: from 1.2.17 before 2.3.25.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\n\nWhen `AshPhoenix.Form.Auto` builds a union sub-form and the submitted `_union_type` does not match a configured type, both raise sites built the message with `inspect(params, pretty: true)`, embedding the full untrusted param map, and also inspected the internal union `constraints[:types]`. Because the message is constructed by the library rather than Phoenix\u0027s parameter logger, `config :phoenix, :filter_parameters` never redacts it. An attacker controls both the trigger and the contents: submitting `%{\"_union_type\" =\u003e \"nope\", \"password\" =\u003e \"...\"}` puts the password verbatim in the raised message. The fix reports only the offending `_union_type` and the valid type names, dropping the param and constraints dumps.\n\nThis issue affects ash_phoenix: from 1.2.17 before 2.3.25."
}
],
"value": "Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page.\n\nWhen AshPhoenix.Form.Auto builds a union sub-form and the submitted _union_type does not match a configured type, both raise sites built the message with inspect(params, pretty: true), embedding the full untrusted param map, and also inspected the internal union constraints[:types]. Because the message is constructed by the library rather than Phoenix\u0027s parameter logger, config :phoenix, :filter_parameters never redacts it. An attacker controls both the trigger and the contents: submitting %{\"_union_type\" =\u003e \"nope\", \"password\" =\u003e \"...\"} puts the password verbatim in the raised message. The fix reports only the offending _union_type and the valid type names, dropping the param and constraints dumps.\n\nThis issue affects ash_phoenix: from 1.2.17 before 2.3.25."
}
],
"impacts": [
{
"capecId": "CAPEC-54",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-54 Query System for Information"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T03:03:58.982Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-5xf4-hgcq-xw7v"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82727.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82727"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_phoenix/commit/0c1775c3cf8988f9abd10a8f92315afc5f06f16d"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshPhoenix Form.Auto leaks submitted params in an unknown _union_type error message"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82727",
"datePublished": "2026-08-31T03:03:58.982Z",
"dateReserved": "2026-08-31T00:59:08.960Z",
"dateUpdated": "2026-08-31T14:49:25.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}