What happened
ash_ai, the LLM tool-calling/structured-output extension for the Ash Framework, evaluated user-supplied prompt content as executable Elixir code via EEx.eval_string/2 without sandboxing, letting an unauthenticated remote client achieve arbitrary code execution — this was part of a coordinated 6-CVE disclosure covering the framework's entire agent stack (prompt evaluation, tool execution, embeddings, MCP server) all fixed in v1.0.0.
Why it matters
This is a pre-model-request RCE — the attacker doesn't need to fool the LLM at all, just submit a crafted prompt string, making it trivially exploitable against any Elixir agentic app built on ash_ai.
Attack vector
AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -> ... end pattern lets a remote, unauthenticated client submit input that is evaluated as executable Elixir code before any model request occurs, achieving arbitrary code execution.
Affected systems
ash-project ash_ai versions >= 0.1.0, < 1.0.0
Mitigation
Upgrade ash_ai to version 1.0.0 or later, which removes the unsafe EEx evaluation path.