CVE-2026-77970 json
Sensitive fields nested in embedded values are not redacted in AshPaperTrail versions
published 2mo ago modified 2mo ago also EEF-CVE-2026-77970 , EUVD-2026-68143 , GHSA-v645-6jm6-cgpj
- cvss
- 5.9
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 1%
- public exploits
- 0
- none known
Summary
Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists.
sensitive_attributes :redact and :ignore only act on the tracked resource's top-level attributes. maybe_redact_changes/3 and the stored-action-input path in AshPaperTrail.Resource.Changes.CreateNewVersion derive the sensitive set from the resource's own attributes and never descend into embedded, union, or list values, so a non-sensitive attribute or action argument that holds an embed with a sensitive? field (for example an accepted credentials embed carrying a token) is written to the version table in cleartext.
This issue affects ash_paper_trail: from 0.3.0 before 0.7.0.
Patch / fix
- hex ash_paper_trail 0.7.0
- ash-project ash_paper_trail 0.7.0
Is CVE-2026-77970 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2mo ago
Exploit prediction
0.12% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- github.com https://github.com/ash-project/ash_paper_trail/security/advisories/GHSA-v645-6jm6-cgpj referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.9 | CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 5.9 | CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hex | ash_paper_trail | >=0.3.0, <0.7.0 |
0.7.0 |
Affected products
- ash-project ash_paper_trail
Classification
- Weakness
-
- CWE-312 Cleartext Storage of Sensitive Information
References
-
github.com
/ash-project/ash_paper_trail/commit/0cd4acfe7f48397673d8594fb5e2cd0f1bda6e40
patch
-
github.com
/ash-project/ash_paper_trail/security/advisories/GHSA-v645-6jm6-cgpj
vendor-advisory, related, exploit, advisory
-
cna.erlef.org
/cves/CVE-2026-77970.html
related, web
-
osv.dev
/vulnerability/EEF-CVE-2026-77970
related
-
hex.pm
/packages/ash_paper_trail
package
Sources
- CVE List CVE-2026-77970
- NVD CVE-2026-77970
- OSV EEF-CVE-2026-77970
- Maintainer advisory GHSA-v645-6jm6-cgpj
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of ash-project/ash_paper_trail published their own advisory on GitHub. Reviewed sources take precedence over it.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.