CVE-2026-77850: ash_admin Stored XSS Vulnerability

CVE-2026-77850 Overview

CVE-2026-77850 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the ash_admin package for the Ash framework in Elixir. The relationship typeahead components render database-sourced label content through Phoenix.HTML.raw/1 without escaping, allowing attacker-controlled record fields to execute JavaScript in an administrator's browser session. Affected versions span 0.13.0 up to (but not including) 1.3.1. Because typeahead dropdowns surface records written by lower-privileged users, any admin who triggers a matching search inherits the payload. Successful exploitation grants the attacker full administrator privileges over resources exposed by AshAdmin.

Critical Impact
A low-privileged user can inject persistent JavaScript that runs with administrator privileges the moment an admin's typeahead search matches the poisoned record.

Affected Products

ash_project/ash_admin versions >= 0.13.0 and < 1.3.1
AshAdmin.Components.Resource.RelationshipField component
AshAdmin.Components.Resource.ManagedRelationshipSelectField component

Discovery Timeline

2026-08-31 - CVE-2026-77850 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-77850

Vulnerability Analysis

The vulnerability resides in two AshAdmin LiveView components that implement relationship typeahead search: RelationshipField and ManagedRelationshipSelectField. Both components highlight the matched search term by wrapping it in <b> tags and then render the resulting string with Phoenix.HTML.raw/1. Because raw/1 disables output escaping for the entire string, any HTML present in the label value is emitted verbatim into the DOM.

The highlighted value is the destination record's label_field, which is ordinary database content typically written by lower-privileged users. An attacker who can create or edit records used as relationship targets can store payloads such as <img src=x onerror=...> in the label field. As soon as an administrator opens a form and the poisoned record surfaces in a typeahead dropdown, the payload executes in the admin's authenticated session.

Root Cause

The root cause is a missing HTML-escape step before regex-based highlight markup is applied. The code applied String.replace/3 to inject <b> tags around the matched substring and then passed the composite string to Phoenix.HTML.raw/1, marking the entire value as trusted HTML. Neither the original label nor the substituted markup was sanitized.

Attack Vector

Exploitation requires an attacker with permission to write to a field that AshAdmin uses as a relationship label_field. The payload persists in the database and triggers when any administrator performs a relationship search matching the record. User interaction on the admin side is limited to typing into the typeahead. The impact is scoped to the admin's browser session and yields JavaScript execution with the admin's privileges across everything AshAdmin exposes.

elixir

// Patch: lib/ash_admin/components/resource/managed_relationship_select_field.ex
              <% escaped_term = Regex.escape(@search_term) %>
              <% suggestion_name =
-                String.replace(to_string(suggestion_name), ~r/(#{escaped_term})/i, "<b>\\0</b>") %>
+                suggestion_name
+                |> to_string()
+                |> Phoenix.HTML.html_escape()
+                |> Phoenix.HTML.safe_to_string()
+                |> String.replace(~r/(#{escaped_term})/i, "<b>\\0</b>") %>
              {Phoenix.HTML.raw(suggestion_name)}
            </li>
          <% end %>
// Source: https://github.com/ash-project/ash_admin/commit/07289191ccdac27dd70ab7c6413ed057bc7fdade

The fix pipes the label through Phoenix.HTML.html_escape/1 and Phoenix.HTML.safe_to_string/1 before applying the highlight regex, ensuring only the injected <b> tags reach raw/1 as HTML.

Detection Methods for CVE-2026-77850

Indicators of Compromise

Records where label_field values contain HTML tags such as <img>, <svg>, <script>, or inline event handlers like onerror= and onload=.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after opening AshAdmin resource forms.
Session token or CSRF token exfiltration observed in web proxy logs originating from /admin routes.
New or modified admin-level records created immediately after an administrator accessed a form with a poisoned relationship dropdown.

Detection Strategies

Query the database for any field configured as a relationship label_field and flag values containing <, >, or on\w+= patterns.
Enable and review Content Security Policy (CSP) violation reports for the AshAdmin routes to catch inline script or unexpected image-source loads.
Inspect application logs for LiveView events on RelationshipField or ManagedRelationshipSelectField components followed by anomalous downstream API calls.

Monitoring Recommendations

Monitor write access to Ash resources whose fields are referenced as label_field values, especially by non-admin roles.
Alert on administrator sessions that trigger unusual privileged actions within seconds of loading a form containing typeahead components.
Track version drift for the ash_admin dependency in build manifests to confirm all environments run >= 1.3.1.

How to Mitigate CVE-2026-77850

Immediate Actions Required

Upgrade ash_admin to version 1.3.1 or later in mix.exs and redeploy all environments running AshAdmin.
Audit records used as relationship targets and sanitize any label_field values that contain HTML markup or script content.
Rotate administrator session cookies and CSRF tokens if there is any indication that a poisoned record was rendered in an admin dropdown.

Patch Information

The fix is available in ash_admin1.3.1. It HTML-escapes the label with Phoenix.HTML.html_escape/1 and Phoenix.HTML.safe_to_string/1 before applying the highlight regex, so only the intentional <b> markup is passed to Phoenix.HTML.raw/1. Details are published in the GitHub Security Advisory GHSA-m23x-576h-73w8, the upstream commit 07289191, and the OSV record for CVE-2026-77850.

Workarounds

Restrict AshAdmin access to trusted network segments or VPN-only routes until the upgrade is deployed.
Enforce a strict Content Security Policy that blocks inline scripts and event-handler execution on AshAdmin routes.
Temporarily change resource configurations to use label_field values that cannot be written by lower-privileged users, such as internal numeric identifiers.

bash

# Upgrade ash_admin in your Elixir project
# 1. Update the dependency in mix.exs
#    {:ash_admin, "~> 1.3.1"}

mix deps.update ash_admin
mix deps.get
mix compile

# Verify the installed version
mix deps | grep ash_admin