← All news

Wednesday 19 August 2026 · Josh Price

August BEAM security advisories: Livebook, Guardian, Ash and more

Three weeks on from the July round-up and the OTP batch, the Erlang Ecosystem Foundation CNA has published another 25 CVEs. Nothing CRITICAL this time, but plenty of HIGHs, and two packages where the obvious patch version doesn't cover everything, so read the Fix lines carefully. As always: grouped by package, ordered by severity (CVSS), worst first, and if you do one thing, run mix hex.audit.

absinthe_federation

  • CVE-2026-67585 HIGH 8.7: unauthenticated GraphQL _entities requests with crafted keys hit String.to_atom/1, exhausting the atom table and crashing the VM.

    Fix Upgrade absinthe_federation to 0.9.3.

Livebook

  • CVE-2026-66298 HIGH 8.6: untrusted notebook JS can synthesize keyboard events from the sandboxed iframe to trigger session shortcuts, forcing cell evaluation or a runtime restart.

  • CVE-2026-68746 HIGH 7.7: Teams identity enforcement fails open when a deployment group can't be resolved, granting unauthenticated access.

  • CVE-2026-66881 HIGH 7.0: relative path traversal in file entry imports lets a malicious notebook write files anywhere the Livebook process can.

  • CVE-2026-66885 MEDIUM 6.8: login CSRF, missing OAuth state/nonce validation in Teams sign-in.

  • CVE-2026-66297 MEDIUM 5.0: env var values interpolated unescaped into generated Docker/Fly.io deployment commands, so $(...) substitution runs.

    Fix Upgrade Livebook to 0.19.9 (or 0.18.7 on the older branch). One upgrade covers all five.

html_sanitize_ex

  • CVE-2026-68749 HIGH 8.2: CPU-exhaustion DoS via unbounded greedy regex in the CSS scrubber, around 2.4s of CPU per 80KB style body.

  • CVE-2026-68750 HIGH 8.2: quadratic sibling traversal, 20k siblings holds a scheduler for about 1.7s.

  • CVE-2026-66370 MEDIUM 4.8: the html5 scrubber keeps form/formaction attributes, so injected inputs can redirect submissions of an existing form.

  • CVE-2026-68747 LOW 2.3: CSS allowlist bypass, at-rules like @import url(//attacker/style.css) survive sanitisation.

  • CVE-2026-66829 LOW 2.3: <meta http-equiv="refresh"> is retained, an open redirect.

  • CVE-2026-66843 LOW 2.3: <object data=...> URI validation only checks a lowercase javascript: prefix.

    Fix Upgrade html_sanitize_ex to 1.5.4. Gotcha: 1.5.3 fixes five of the six but not the @import bypass, so don't stop there.

guardian

  • CVE-2026-55735 HIGH 8.2: Guardian.revoke/3 decodes tokens without verifying the signature, so an unauthenticated attacker with a forged JWT can revoke victims' sessions.

  • CVE-2026-55733 MEDIUM 6.9: atom exhaustion in Guardian.Permissions.AtomEncoding on untrusted input.

  • CVE-2026-55734 MEDIUM 6.9: atom exhaustion via untrusted permission map keys.

  • CVE-2026-54894 MEDIUM 6.9: atom exhaustion in Guardian.Plug.Keys when key names come from attacker-influenced input like tenant IDs.

    Fix Upgrade guardian to 2.4.1. One bump covers all four.

ash

  • CVE-2026-67579 HIGH 7.5: filter expression injection via forged keyset pagination cursors. Deserialised %Ash.Query.Call{} structs bypass the safety gates, which means SQL injection on AshPostgres or in-process code execution on the ETS/Simple data layers.

  • CVE-2026-69659 MEDIUM 5.9: keyset cursors accept zlib-compressed binary_to_term payloads with no size cap, kilobytes in, tens of megabytes out.

  • CVE-2026-70395 LOW 2.1: predicate injection in manage_relationship belongs_to lookups can leak secret lookup keys.

    Fix Upgrade ash to 3.31.3. Gotcha: 3.31.1 fixed the two lower ones but not the HIGH filter injection, which landed three days later. Go straight to 3.31.3.

oidcc_plug

  • CVE-2026-66883 MEDIUM 6.3: a case-sensitive "User-Agent" header lookup silently disables session user-agent binding even with check_useragent: true.

  • CVE-2026-66884 LOW 2.1: the authorization callback accepts callbacks missing session state, a CSRF enabling forced login.

    Fix Upgrade oidcc_plug to 0.5.0.

cowlib

  • CVE-2026-43971 MEDIUM 6.3: cow_link:link/1 interpolates unescaped > in target URIs and "/\ in rel values, letting attackers smuggle arbitrary Link header entries.

    Fix No tagged release at time of writing; the fix is commit 89da27e. If you build Link headers from user input, sanitise it (reject > in targets and quotes/backslashes in rel values) and watch for the next cowlib release.

postgrex

  • CVE-2026-66838 MEDIUM 5.9: SQL injection via the :comment option of Postgrex.stream/4, where a */ closes the comment block early. Only stream/4 skips the comment validation.

    Fix Upgrade postgrex to 0.22.4.

oaskit

  • CVE-2026-66296 MEDIUM 5.1: reflected XSS, the default HTML error handler interpolates request-controlled values unescaped.

    Fix Upgrade oaskit to 0.14.1, or set html_errors: false.

phoenix_live_view

  • CVE-2026-64941 LOW 2.1: open redirect, validate_local_url!/2 didn't strip the ASCII tab/newline characters browsers ignore when parsing URLs.

    Fix Upgrade phoenix_live_view to 1.2.9 (or 1.1.33 / 1.0.19 on older branches). Yes, again; we bumped this site's lockfile too.

What to do

  1. Run mix hex.audit, and let Hex 2.5 fail CI on a vulnerable lockfile (see the Hex 2.5 write-up).
  2. Patch worst first: the Guardian revoke/3 signature bypass and the Livebook trio if you run either, then the DoS pile.
  3. Mind the two version gotchas: html_sanitize_ex needs 1.5.4 (not 1.5.3) and ash needs 3.31.3 (not 3.31.1).
  4. Watch the EEF CNA advisory list.

The theme this month is untrusted input reaching places that assume trust: atoms, filters, cursors, sanitisers. Nothing here is a remote takeover of a patched stack, but the Guardian and Ash ones are genuinely nasty in the wrong app shape, so run the audit today rather than at the next meetup.