CVE-2026-119613

AshAi returned internal exception text to models and tool callers

Ash Project · AshAi MCP server and model tool loop

First documented disclosure · Review checkpoint

Summary

A failed tool action could expose internal names and data values to an MCP caller or place those details in a model’s context.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed public disclosures do not report exploitation in the wild.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The tool error formatter forwarded unrecognized exceptions and unencodable results without removing internal application data.

Conditions required

A caller can invoke an affected tool or resource read that fails. Disclosed values depend on the operation and its error.

Potential impact

A tool result could expose fields outside its normal return schema, including values from an internal record.

Affected versions and configurations

1.5.0 up to 1.5.1, exclusive.

Fix and mitigation status

1.5.1.

Practical next steps

Upgrade ash_ai to 1.5.1. The fix records details in application logs and gives the tool caller an error identifier.

Operating lesson

Apply output restrictions to errors as well as successful tool responses.

Evidence and limits

The project published its advisory November 7. The Erlang Ecosystem Foundation published the CVE record November 9.

Sources