External risk intelligence

Ash AI Prompt Injection Vulnerability Allows Remote Code Execution.

CVE advisorySeverity: HIGH (CVSS 8.9)

CVE-2026-77956

The vulnerability exists in a library designed to handle AI prompts and actions within web-based applications. These services are commonly deployed as public-facing API endpoints or web interfaces to allow users to interact with AI models, making the vulnerable prompt-handling functionality reachable from the internet in standard application deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the ash_ai component allows unauthenticated attackers to execute code on the server by manipulating prompt content. This occurs because the system improperly evaluates user-supplied prompt text as executable code before processing AI model requests. The main concern is confirming relevance and exposure within your environment.

Code can run remotely on servers.
Matters for applications processing AI prompts.
Verify if your systems use this component.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted input to a prompt action that incorporates request data. This input is then compiled and executed as Elixir code on the server, potentially allowing the attacker to run arbitrary commands before any model interaction occurs.

No authentication required to reach the feature.
Exploited by sending malicious input to a prompt.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote, unauthenticated client could execute arbitrary Elixir code on the server by crafting malicious input for prompt actions. This occurs when prompt content, which can incorporate request data, is evaluated as EEx code before any model request is processed.

Server-side code execution.
Prompt input is evaluated as EEx.
Potential for system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners responsible for services using ash_ai should first identify all instances of the affected technology, determine their exposure, and confirm business criticality to prioritize remediation efforts.

Application owners should own the issue.
Verify prompt content evaluation.
Plan vendor coordination and updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ash_ai library used for?

The ash_ai library is a component within the Ash framework ecosystem used by developers to integrate artificial intelligence capabilities into their Elixir applications. It provides functionality to manage and process AI prompts and interactions. It is typically found in web services that enable users to submit text or data to AI models, serving as a bridge between the application's internal data logic and external AI model services.

How does CVE-2026-77956 allow code injection?

This vulnerability, classified as CWE-94: Improper Control of Generation of Code, occurs when the library takes user-provided text—meant for an AI prompt—and processes it as executable code. Because the system evaluates this content using EEx before sending it to an AI model, a malicious user can inject valid Elixir syntax. This allows the server to run unintended commands embedded within the prompt, which are executed immediately upon receipt.

What triggers the vulnerability in ash_ai?

The vulnerability is triggered when an application utilizes a prompt action that incorporates request data directly into its text. By sending a crafted input to one of these actions, an attacker can force the system to compile and execute their injected content. It is important to note that this bug is not triggered by static, hard-coded prompt templates; the issue is specifically caused by the dynamic evaluation of user-supplied prompt text.

Is my application at risk?

According to Halo Surface Signal, this vulnerability is classified as likely to be exposed. Since ash_ai is designed to handle AI prompts within web applications, these features are frequently deployed as public-facing API endpoints or interactive web interfaces. If your application provides an interface that allows users to influence or input prompt data, the vulnerable functionality is often reachable directly from the internet.

How should I respond to this vulnerability?

The first step is to perform an inventory of your software stack to identify all services using the affected ash_ai versions. Once identified, evaluate whether your application prompts utilize the vulnerable dynamic evaluation pattern. Prioritize these systems for updates or remediation as directed by the maintainers. Ensure that your remediation plans involve coordinating with your development teams to remove or secure the specific prompt action logic identified.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.