The ash_admin library is vulnerable to stored cross-site scripting, which allows an authenticated attacker to execute arbitrary JavaScript in the context of an administrator's session.

The vulnerability exists due to improper neutralization of input in the AshAdmin.Components.Resource.RelationshipField and ManagedRelationshipSelectField components. An authenticated user can inject malicious payloads into database content that is subsequently rendered without output escaping, triggering script execution when an administrator interacts with the affected UI elements.

Successful exploitation grants an attacker the full privileges of the targeted administrator within the ash_admin interface. This could lead to unauthorized configuration changes, data exfiltration, or complete takeover of the administrative dashboard. With a CVSS score of 8.4, this high-severity flaw poses a significant risk to organizational integrity and data confidentiality.

Immediate Action: Upgrade the ash_admin package to version 1.3.1 or later to ensure proper HTML escaping of label fields.

Proactive Monitoring: Review application access logs for anomalous requests, particularly those involving the creation or modification of records that appear in typeahead or relationship selection components.

Compensating Controls: Deploy a Content Security Policy (CSP) to restrict the execution of unauthorized inline scripts, which may mitigate the impact of this XSS vulnerability if immediate patching is not feasible.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for full administrative compromise, organizations using ash_admin must prioritize this update. Verify that all instances are running version 1.3.1 or later to prevent malicious actors from leveraging stored XSS to hijack high-privileged sessions.