What happened
AshAi.ToToolError incorrectly returns the raw error field of Ash.Error.Unknown.UnknownError, and AshAi.Tool.Errors.format/1 forwards that text to MCP clients and to the model. The full Exception.format/2 or inspect/1 output can include whole records with fields the tool never intended to expose. CWE-209, CVSS 4.0 5.3 (Medium).
Why it matters
In an agentic/MCP setup, a tool that leaks internal module names and record field values to the LLM or to an MCP client can expose sensitive business data and aid subsequent prompt-injection or reconnaissance — and the errors were not logged, weakening incident response.
Attack vector
An authenticated caller makes an AshAi tool call fail in a way that cannot be JSON-encoded, causing the raw exception/inspect output (module names and inspected record values the tool never returns) to be sent to MCP clients (tool calls and resource reads) and to the model in AshAi.ToolLoop
Affected systems
ash_ai (Elixir Ash framework AI tools) 1.5.0 before 1.5.1
Mitigation
Upgrade to ash_ai 1.5.1, which logs errors under an ID and returns only that ID to the caller; constrain which data a failing tool can expose (commit af7987769d78ed070c8a9f6e6ee542d91744eae6 / advisory GHSA-vhmw-fwrr-r6c6)