A maximum-severity advisory landed against ash_ai, the AI extension for the Elixir Ash framework. The defect is in how a prompt is turned into text: prompt content is passed through EEx, Elixir's template engine, and evaluated. Anything inside EEx's interpolation markers is therefore not data — it is Elixir source code, executed on the server.
Why it scores 10.0
Because the vulnerable path is the documented one. The affected pattern is the ordinary way the library's prompt action is written, so a straightforward deployment is exposed without doing anything unusual. If any part of the prompt is assembled from user input — a chat message, a search query, a support ticket, a filename — that input reaches a code evaluator. The result is unauthenticated remote code execution with no privileges required.
The detail that defeats every AI-layer defence
Evaluation happens while the prompt string is being built — before the request is sent to any model. Prompt-injection filters, system-prompt hardening, output moderation, tool-call allowlists and human approval gates all operate at or after the model boundary. Every one of them sits downstream of the vulnerable line. This is not a prompt-injection bug that an alignment control might catch; it is template injection that happens to live in a prompt, and the AI stack around it is irrelevant to it.
What the common framing gets wrong
"Patched in 1.0.0" reads like a routine upgrade instruction. It is not. 1.0.0 is a major release whose notes open with a breaking change — a dependency moved to optional — and there is no backported patch on the previous line. So the remediation for a CVSS 10.0 is a major-version migration, which is exactly the kind of upgrade a team schedules rather than applies. The advisory's severity says tonight; the release's shape says next sprint.
The pattern worth naming
Template engines inside prompt construction are becoming common, because prompts are strings with variables in them and a template engine is the obvious tool. The trap is that general-purpose template engines were built to render code-generated markup for trusted authors, not to interpolate untrusted runtime input. Anywhere user text flows into a template that supports expression evaluation, the same class of bug is available regardless of language.