The ash_ai library is vulnerable to unauthenticated remote code execution, posing a critical risk to server integrity and data confidentiality.

This vulnerability involves improper control of code generation (CWE-94) where the AshAi.Actions.Prompt module improperly evaluates user-supplied prompt content using EEx.eval_string/2. An unauthenticated remote attacker can inject arbitrary Elixir code, such as system commands, into prompt arguments, which the server then executes during template compilation.

A successful exploit grants an attacker full remote code execution capabilities on the host server. Given the CVSS score of 10.0, this represents the highest level of severity, potentially leading to total system compromise, unauthorized access to sensitive data, and complete operational disruption.

Immediate Action: Upgrade the ash_ai package to version 1.0.0 or later to ensure prompt content is no longer evaluated as executable EEx templates.

Proactive Monitoring: Review server logs for suspicious input patterns directed at prompt actions, specifically looking for EEx syntax or unauthorized system calls.

Compensating Controls: Implement strict input validation or sanitization layers at the application gateway to inspect prompt arguments for embedded code structures if immediate patching is not feasible.

Public Exploit Available: Unknown

This vulnerability is critical and requires immediate attention to prevent unauthorized remote access. Organizations utilizing the ash_ai library must prioritize updating to the patched version, as the current implementation allows trivial execution of arbitrary code by any remote client.