Product by Ash-project
Ash AI
7 known vulnerabilities in Ash AI (Ash-project), 0 of them actively exploited (CISA KEV).
Key figures
7
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-82564 | Ash-project Ash AI: Authorization Bypass Through User-Controlled Key | — | |
| High | CVE-2026-75760 | Ash-project Ash AI: Generation of Error Message Containing Sensitive Information | — | |
| High | CVE-2026-77956 | EEx template evaluation of prompt content in AshAi enables remote code execution | — | |
| Medium | CVE-2026-82579 | AshAi tool loop never terminates when all tool calls are filtered out, enabling denial of service | — | |
| Medium | CVE-2026-78230 | AshAi aggregate tool can read field-policy-protected fields | — | |
| High | CVE-2026-81315 | MCP DNS-rebinding origin check in AshAi is bypassed by a spoofed X-Forwarded-Proto header | — | |
| Medium | CVE-2026-82580 | AshAi echoes raw tool exception messages into the conversation, disclosing internal details | — |