EEF-CVE-2026-82732

## Summary

Improper Input Validation vulnerability in ash-project ash\_typescript allows a remote attacker to submit argument values outside a declared allowlist or bound on typed-controller routes.

AshTypescript.TypedController.RequestHandler in lib/ash\_typescript/typed\_controller/request\_handler.ex calls Ash.Type.cast\_input/3 and treats an {:ok, cast} result as fully validated. In Ash these are separate steps: cast\_input/3 only coerces the term, while every constraint declared on the argument is applied by Ash.Type.apply\_constraints/3, which this path never calls. Constraints such as one\_of, max\_length, min and max, and match are therefore inert, so a value outside a declared allowlist is accepted and passed to the route handler. Codegen renders the same constraints into the generated TypeScript types, so an allowlist appears enforced to a TypeScript caller while any other HTTP client ignores it. Empty-string to nil normalization also lives in apply\_constraints, so the allow\_nil?: false check accepts "" for a required argument.

Where a constraint gates a role, a status, or a sort direction, this becomes a privilege or state-machine bypass.

This issue affects ash\_typescript: from 0.15.0 before 0.18.0.

## Configuration

The application exposes an AshTypescript typed controller over HTTP with at least one route argument carrying a constraints declaration that gates application behaviour.