{"id":8887,"date":"2026-11-13T16:17:01","date_gmt":"2026-11-13T16:17:01","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure"},"modified":"2026-11-13T16:17:01","modified_gmt":"2026-11-13T16:17:01","slug":"cve-2026-119613-ashai-tool-error-information-disclosure","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/cve-2026-119613-ashai-tool-error-information-disclosure","title":{"rendered":"CVE-2026-119613: AshAi tool error messages leak internal module names and data"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What:<\/strong> AshAi 1.5.0 sent raw exception text and internal error details to tool callers (MCP clients and LLMs) when tool actions failed, exposing module names, function names, and data values.<\/li><li><strong>Who is affected:<\/strong> Applications serving tools through AshAi.Mcp.Router or AshAi.ToolLoop in version 1.5.0.<\/li><li><strong>What to do:<\/strong> Upgrade to AshAi 1.5.1 or later. If you relied on <code>{:error, &quot;message}<\/code> reaching the caller, return an exception that implements AshAi.ToToolError instead.<\/li><li><strong>Severity:<\/strong> Medium (CVSS 5.3), information disclosure vulnerability.<\/li><li><strong>Status:<\/strong> Patched in version 1.5.1.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">In plain English<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">AshAi is a tool that helps AI agents interact with applications. Version 1.5.0 had a bug where, if something went wrong when an AI agent called a tool, the error message sent back included technical details like internal code names and data values that should have stayed private. An attacker who could call these tools could deliberately trigger errors to learn about the internal workings of the application. Version 1.5.1 fixes this by logging the full error privately and only sending a generic error message with an ID to the caller. If you use AshAi to build AI tools, you should upgrade to 1.5.1. If you don&#8217;t use AshAi, you can ignore this.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">AshAi 1.5.0 introduced an implementation of AshAi.ToToolError for Ash.Error.Unknown.UnknownError that returned the error&#8217;s raw text field without filtering. When a tool action raised an exception, returned a bare <code>{:error, term}<\/code>, or produced a result that could not be JSON-encoded, Ash wrapped the error in UnknownError and stored the full Exception.format\/2 output or inspect\/1 of the term in that field.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">AshAi.Tool.Errors.format\/1 then sent this unfiltered text to tool callers through AshAi.Mcp.Server (for MCP tool calls and resource reads) and AshAi.ToolLoop (for LLM interactions). The error text often included internal module names, function names, and data values. For Protocol.UndefinedError (triggered when a result could not be encoded), the text included the full inspected value, which could be an entire record with fields the tool would never normally return. None of these errors were logged.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A caller with tool access could send unexpected or malformed arguments to make a tool fail, then read the returned error text to learn internal implementation details and data values. Before version 1.5.0, UnknownError had no AshAi.ToToolError implementation and callers received a generic unexpected error occurred message.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What you should do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Upgrade to AshAi 1.5.1 or later. If you cannot upgrade immediately, stay on version 1.4.x until you can.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If your application relied on <code>{:error, message}<\/code> reaching the caller, you must now return an exception that implements the AshAi.ToToolError protocol instead.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What it means<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This vulnerability allowed information disclosure (CWE-209) in applications serving tools through AshAi.Mcp.Router or the tool loop. Anyone who could call a tool could probe for inputs that caused failures and read back internal module names and values, with no audit trail.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The fix in version 1.5.1 logs errors that AshAi.ToToolError does not describe in full under an error ID, and returns only unexpected error occurred (error id: &#8230;)&#8221; to the caller. This prevents information leakage while preserving debugging capability through server logs.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/cna.erlef.org\/cves\/CVE-2026-119613.html\" target=\"_blank\" rel=\"noreferrer noopener\">Erlang Ecosystem Foundation CVE-2026-119613<\/a><\/li><li><a href=\"https:\/\/github.com\/ash-project\/ash_ai\/security\/advisories\/GHSA-vhmw-fwrr-r6c6\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub Security Advisory GHSA-vhmw-fwrr-r6c6<\/a><\/li><li><a href=\"https:\/\/github.com\/ash-project\/ash_ai\/commit\/af7987769d78ed070c8a9f6e6ee542d91744eae6\" target=\"_blank\" rel=\"noreferrer noopener\">Fix commit af79877<\/a><\/li><li><a href=\"https:\/\/github.com\/ash-project\/ash_ai\/commit\/fbad04e9620ef70603f4e67e03f15092f58578f6\" target=\"_blank\" rel=\"noreferrer noopener\">Introducing commit fbad04e<\/a><\/li><li><a href=\"https:\/\/osv.dev\/vulnerability\/EEF-CVE-2026-119613\" target=\"_blank\" rel=\"noreferrer noopener\">OSV record EEF-CVE-2026-119613<\/a><\/li><li><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-119613\" target=\"_blank\" rel=\"noreferrer noopener\">NVD CVE-2026-119613<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>AshAi 1.5.0 sent unfiltered error messages to MCP clients and LLMs, exposing internal module names, function names, and data values when tool calls failed.<\/p>\n","protected":false},"author":2,"featured_media":8886,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"medium","_nx_sec_affected":"AshAi 1.5.0","_nx_sec_status":"patch-available","_nx_sec_kicker":"ALERT: AshAi tool errors leak internal details to callers","_nx_sec_type":"mcp","_nx_sec_vendor":"Ash Project","_nx_sec_fixed":"1.5.1","_nx_sec_action":""},"categories":[65,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-8887","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-security","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CVE-2026-119613: AshAi error disclosure vulnerability<\/title>\n<meta name=\"description\" content=\"CVE-2026-119613 in AshAi 1.5.0 sends raw exception text to tool callers, exposing internal module names and data values. Fixed in version 1.5.1.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-119613: AshAi error disclosure vulnerability\" \/>\n<meta property=\"og:description\" content=\"CVE-2026-119613 in AshAi 1.5.0 sends raw exception text to tool callers, exposing internal module names and data values. Fixed in version 1.5.1.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-13T16:17:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-119613-ashai-tool-error-information-disclosure-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-119613-ashai-tool-error-information-disclosure#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-119613-ashai-tool-error-information-disclosure\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"CVE-2026-119613: AshAi tool error messages leak internal module names and data\",\"datePublished\":\"2026-11-13T16:17:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-119613-ashai-tool-error-information-disclosure\"},\"wordCount\":549,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-119613-ashai-tool-error-information-disclosure#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-119613-ashai-tool-error-information-disclosure-title.webp\",\"articleSection\":[\"AI Security\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-11-13T16:17:01+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-119613-ashai-tool-error-information-disclosure\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-119613-ashai-tool-error-information-disclosure\",\"name\":\"CVE-2026-119613: AshAi error disclosure vulnerability\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-119613-ashai-tool-error-information-disclosure#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-119613-ashai-tool-error-information-disclosure#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-119613-ashai-tool-error-information-disclosure-title.webp\",\"datePublished\":\"2026-11-13T16:17:01+00:00\",\"description\":\"CVE-2026-119613 in AshAi 1.5.0 sends raw exception text to tool callers, exposing internal module names and data values. Fixed in version 1.5.1.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-119613-ashai-tool-error-information-disclosure#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-119613-ashai-tool-error-information-disclosure\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-119613-ashai-tool-error-information-disclosure#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-119613-ashai-tool-error-information-disclosure-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/cve-2026-119613-ashai-tool-error-information-disclosure-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"Image: AI-generated, i10X\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/cve-2026-119613-ashai-tool-error-information-disclosure#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CVE-2026-119613: AshAi tool error messages leak internal module names and data\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"},\"subjectOf\":[{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/papers.ssrn.com\\\/abstract=7426699\",\"name\":\"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/www.heise.de\\\/news\\\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html\",\"name\":\"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT\"},{\"@type\":\"CreativeWork\",\"url\":\"https:\\\/\\\/t3n.de\\\/news\\\/bewerbung-schreiben-ki-5-fehler-1747190\\\/\",\"name\":\"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden\"}]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CVE-2026-119613: AshAi error disclosure vulnerability","description":"CVE-2026-119613 in AshAi 1.5.0 sends raw exception text to tool callers, exposing internal module names and data values. Fixed in version 1.5.1.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure","og_locale":"en_US","og_type":"article","og_title":"CVE-2026-119613: AshAi error disclosure vulnerability","og_description":"CVE-2026-119613 in AshAi 1.5.0 sends raw exception text to tool callers, exposing internal module names and data values. Fixed in version 1.5.1.","og_url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure","og_site_name":"i10X News","article_published_time":"2026-11-13T16:17:01+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/cve-2026-119613-ashai-tool-error-information-disclosure-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_image":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/i10x-news-og-default-1200x630-1.png","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"CVE-2026-119613: AshAi tool error messages leak internal module names and data","datePublished":"2026-11-13T16:17:01+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure"},"wordCount":549,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-119613-ashai-tool-error-information-disclosure-title.webp","articleSection":["AI Security","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-11-13T16:17:01+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure","url":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure","name":"CVE-2026-119613: AshAi error disclosure vulnerability","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-119613-ashai-tool-error-information-disclosure-title.webp","datePublished":"2026-11-13T16:17:01+00:00","description":"CVE-2026-119613 in AshAi 1.5.0 sends raw exception text to tool callers, exposing internal module names and data values. Fixed in version 1.5.1.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-119613-ashai-tool-error-information-disclosure-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/cve-2026-119613-ashai-tool-error-information-disclosure-title.webp","width":1344,"height":768,"caption":"Image: AI-generated, i10X"},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/cve-2026-119613-ashai-tool-error-information-disclosure#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"CVE-2026-119613: AshAi tool error messages leak internal module names and data"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"},"subjectOf":[{"@type":"CreativeWork","url":"https:\/\/papers.ssrn.com\/abstract=7426699","name":"The Style Penalty: How AI Resume-Writing Tools Shape Outcomes in Automated Hiring Screens"},{"@type":"CreativeWork","url":"https:\/\/www.heise.de\/news\/KI-Chatbots-bewerten-KI-Lebenslaeufe-Claude-findet-sich-besser-als-GPT-11317531.html","name":"KI-Chatbots bewerten KI-Lebensl\u00e4ufe: Claude findet sich besser als GPT"},{"@type":"CreativeWork","url":"https:\/\/t3n.de\/news\/bewerbung-schreiben-ki-5-fehler-1747190\/","name":"Bewerbung mit KI schreiben: Diese 5 Fehler solltet ihr laut Studien vermeiden"}]}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8887","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=8887"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/8887\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/8886"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=8887"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=8887"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=8887"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=8887"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=8887"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}