CVE-2026-77956 EEx template evaluation of prompt content in AshAi enables remote code execution
Remote unauthenticated attackers can execute arbitrary Elixir code via EEx template injection in AshAi prompt actions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77956?
CVE-2026-77956 is a high-severity code injection vulnerability in ash-project ash_ai, published on 31 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code.
AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -> ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as an EEx template (Elixir source). Content such as <%= System.cmd(...) %> therefore executes on the server before any model request is made, requiring no authentication beyond reaching a prompt action. The fix stops evaluating function-supplied prompt content as EEx; only statically configured templates are evaluated.
This issue affects ash_ai: from 0.1.0 before 1.0.0.
Weakness: CWE-94
Which versions are affected by CVE-2026-77956?
1 open source package ship an affected version, including ash_ai.
| Package | Affected | Fixed in |
|---|---|---|
ash_ai Hex | From 0.1.0 | 1.0.0 |
How do I fix CVE-2026-77956?
Upgrade ash_ai to 1.0.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-77956 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77956 exists.
Sources
Also known as EEF-CVE-2026-77956, GHSA-2g59-hg7m-qc83.