{"answers":{"affected":"1 open source package ship an affected version, including ash_paper_trail.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77970 exists.","fix":"Upgrade ash_paper_trail to 0.7.0 or later.","what":"CVE-2026-77970 is a medium-severity vulnerability in ash-project ash_paper_trail, published on 30 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-77970 and fix it if it is affected.\n\nWhat it is: CVE-2026-77970 is a medium-severity vulnerability in ash-project ash_paper_trail, published on 30 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77970 exists.\n\nAffected packages and fixed versions:\n- ash_paper_trail (Hex): affected from 0.3.0; fixed in 0.7.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-77970/ (Markdown: https://insights.sbomify.com/CVE-2026-77970/index.md)","id":"CVE-2026-77970","markdown":"https://insights.sbomify.com/CVE-2026-77970/index.md","name":"CVE-2026-77970","record":{"aliases":["EEF-CVE-2026-77970","GHSA-v645-6jm6-cgpj"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Elixir AshPaperTrail library","requires_auth":"none","summary":"Attackers with read access can recover sensitive nested data from version history because redaction logic fails to descend into embedded resources.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"EEF","cpe":[],"cvss":{"score":5.9,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-312","name":"Cleartext Storage of Sensitive Information"}],"description":"Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists.\n\nsensitive_attributes :redact and :ignore only act on the tracked resource's top-level attributes. maybe_redact_changes/3 and the stored-action-input path in AshPaperTrail.Resource.Changes.CreateNewVersion derive the sensitive set from the resource's own attributes and never descend into embedded, union, or list values, so a non-sensitive attribute or action argument that holds an embed with a sensitive? field (for example an accepted credentials embed carrying a token) is written to the version table in cleartext.\n\nThis issue affects ash_paper_trail: from 0.3.0 before 0.7.0.","ecosystems":["Hex"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions","id":"CVE-2026-77970","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Hex","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":1,"n_references":4,"next":{"headline":"safeurl validated address is not bound to the request, allowing DNS rebinding","id":"CVE-2026-77972"},"packages":[{"ecosystem":"Hex","fixed":["0.7.0"],"introduced":["0.3.0"],"last_affected":[],"package":"ash_paper_trail","purl":"pkg:hex/ash_paper_trail","source":"EEF-CVE-2026-77970"}],"prev":{"headline":"Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount","id":"CVE-2026-77968"},"products":["ash_paper_trail"],"published":"2026-08-30","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Erlang Ecosystem Foundation","prefix":"EEF"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-31","vendors":["ash-project"]},"summary":"Attackers with read access can recover sensitive nested data from version history because redaction logic fails to descend into embedded resources.","url":"https://insights.sbomify.com/CVE-2026-77970/"}