ash_ai turns prompt text into Elixir code, CVSS 8.9

AshAi.Actions.Prompt, part of the Ash Framework's AI extension for Elixir, runs prompt content through EEx.eval_string, the language's template evaluator. The documented way to build a prompt is a function taking request input and context and returning prompt text. If that text includes anything from the request, an attacker can put Elixir code in a request field and have the server run it. NVD scored it 8.9 and logged it as CVE-2026-77956. No login required.

This sits next to a separate ash_ai bug in the same disclosure window, a DNS-rebinding issue. The two are unrelated mechanically. This one is worse: DNS rebinding needs a specific network setup to exploit, while this needs nothing but a prompt action that touches request data, which is most of them.

The root cause isn't Ash-specific. EEx.eval_string does exactly what a template evaluator is built to do: turn a string into running code. The mistake is upstream, treating a prompt as a plain string when part of it came from outside the app. Any prompt-templating layer in any language that concatenates user input and then evaluates the result, rather than just interpolating it as data, has this exact hole. Given how many teams are wiring LLM calls into existing web frameworks right now, I'd expect this pattern to turn up again somewhere else before the year's out.

If you're running ash_ai, check whether any prompt function pulls from action arguments and treat that as remote code execution until proven otherwise.