Stored XSS in AshAdmin relationship typeahead via unescaped label_field content

Path traversal in AshAdmin file uploads via unsanitized client filename

AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)

AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle

AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

Query-parameter injection in AshAdmin row-action links via unencoded string primary keys