CVE-2026-82731: ash_typescript Open Redirect Vulnerability

CVE-2026-82731 Overview

CVE-2026-82731 is an Open Redirect vulnerability [CWE-601] in the ash-project ash_typescript library. The flaw resides in lib/ash_typescript/typed_controller/codegen/route_renderer.ex, where URL builders interpolate :param path placeholders without calling encodeURIComponent. An attacker who controls a path-parameter value can redirect a generated client's request, along with its attached credentials from TypedControllerConfig, to an unintended route or an external origin. Values containing ../, ?, #, or protocol-relative prefixes (//evil.example.com/x) alter the resolved URL. The issue affects ash_typescript versions from 0.15.0 before 0.18.0.

Critical Impact
Attacker-controlled path parameters can leak credentials from generated TypeScript clients to attacker-controlled hosts.

Affected Products

ash-project ash_typescript >= 0.15.0
ash-project ash_typescript < 0.18.0
Generated TypeScript clients using executeTypedControllerRequest

Discovery Timeline

2026-09-01 - CVE-2026-82731 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82731

Vulnerability Analysis

The ash_typescript library generates TypeScript API clients from Ash resource definitions. The route renderer builds URL templates by substituting each :param placeholder with a bare TypeScript template interpolation such as ${path.paramName}. The generated code passes these values directly into executeTypedControllerRequest without percent-encoding.

Because the fetch URL resolver normalizes and interprets special characters, a caller who controls a path parameter can influence the final request target. A ../ sequence collapses path segments and reaches a different route. A ? or # truncates the path and injects or overrides query parameters. When a route path begins with a parameter, supplying /evil.example.com/x produces the protocol-relative URL //evil.example.com/x. The browser then issues the request, and any credentials configured in TypedControllerConfig, to the attacker-controlled origin.

The query-string path is not affected because URLSearchParams.set encodes its own values.

Root Cause

Runtime input is not constrained. The helper get_path_param_type/2 emits only a TypeScript type annotation, which is erased at compile time and provides no runtime validation. The interpolation in build_url_template performs a raw String.replace on :param tokens without wrapping values in encodeURIComponent.

Attack Vector

Exploitation requires an attacker to control a path-parameter value passed to a generated client. This typically arises when parameter values originate from URLs, user input, or upstream data. User interaction is required to trigger the outbound request. Successful exploitation redirects the request and its bearer credentials to an attacker-chosen host.

elixir

// Patch: lib/ash_typescript/typed_controller/codegen/route_renderer.ex
defp build_url_template(path, path_params, use_path_prefix, has_base_path) do
    template =
      Enum.reduce(path_params, path, fn param, acc ->
-        interpolation =
-          if use_path_prefix do
-            "${#{format_output_field(:path)}.#{format_output_field(param)}}"
-          else
-            "${#{format_output_field(param)}}"
-          end
-
+        interpolation = path_param_interpolation(param, use_path_prefix)
         String.replace(acc, ":#{param}", interpolation)
       end)

Source: GitHub Commit 5165f752. The fix routes interpolation through path_param_interpolation/2, which wraps values with encodeURIComponent before insertion.

Detection Methods for CVE-2026-82731

Indicators of Compromise

Outbound HTTP requests from browsers to unexpected external hosts carrying Authorization headers or session cookies from the application origin.
Server access logs showing path traversal patterns (../) or embedded ? and # characters in generated route URLs.
Requests where the fetched URL resolves to a protocol-relative target such as //attacker.tld/....

Detection Strategies

Perform static code review of generated TypeScript clients for :param template interpolations lacking encodeURIComponent.
Inventory Elixir dependencies and flag any ash_typescript version between 0.15.0 and 0.18.0.
Inspect network telemetry from browser clients for cross-origin fetches that include first-party credentials.

Monitoring Recommendations

Log and alert on outbound requests to unapproved domains that originate from application session contexts.
Enable Content Security Policy connect-src restrictions to constrain where client fetches can reach.
Track dependency updates for ash_typescript in software composition analysis (SCA) tooling.

How to Mitigate CVE-2026-82731

Immediate Actions Required

Upgrade ash_typescript to version 0.18.0 or later and regenerate all downstream TypeScript clients.
Audit consumers of generated clients for any path parameters sourced from untrusted input.
Rotate any bearer tokens or session credentials that may have been transmitted to unexpected origins.

Patch Information

The fix is available in ash_typescript 0.18.0. It replaces raw template interpolation with path_param_interpolation/2, which calls encodeURIComponent on path values before they are inserted into the generated URL. See the GitHub Security Advisory GHSA-6g23-p936-fm2f and CNA advisory for full details.

Workarounds

Validate path parameters against an allowlist before passing them to generated client functions.
Wrap path values with encodeURIComponent at call sites until the upgrade is applied.
Restrict browser egress with a strict Content Security Policy connect-src directive.

bash

# Update ash_typescript in mix.exs and fetch the patched release
mix deps.update ash_typescript
mix deps.get
mix ash_typescript.codegen