EEF-CVE-2026-82731

## Summary

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ash-project ash\_typescript allows an attacker who controls a path-parameter value to redirect a generated client's request, and the credentials attached to it, to an unintended route or an external origin.

The URL builders in lib/ash\_typescript/typed\_controller/codegen/route\_renderer.ex replace each :param placeholder with a bare template interpolation and never call encodeURIComponent, so the value reaches executeTypedControllerRequest raw. A value containing ../ is normalised away by the fetch URL resolver and reaches a different route, while ? or # truncates the path and can smuggle or override query parameters. For a route whose path begins with a parameter, a value such as /evil.example.com/x yields the protocol-relative URL //evil.example.com/x, sending the request and the credentials from TypedControllerConfig to an attacker-controlled host. Nothing constrains the value at runtime: get\_path\_param\_type/2 emits only a TypeScript type, which is erased.

The query-string path is unaffected, since URLSearchParams.set encodes its own values.

This issue affects ash\_typescript: from 0.15.0 before 0.18.0.

## Configuration

The application ships a TypeScript client generated by AshTypescript for a typed-controller route taking a path parameter, and passes untrusted input as that parameter.